What is Listening on a TCP Port?

To find what is listening on a TCP/IP port, open a terminal and go to a shell command-line, and use lsof, a command that LiSts Open Files (TCP ports are considered a type of file in UNIX). This checks all listening ports:

lsof -i -P -n | grep LISTEN

The following check is specific to port 5432:

lsof -i :5432

These commands work for most Linux flavors.

Host level tools answer what is listening now, but not what happened during an incident that has already passed. A continuous record from network capture answers the retrospective question: which sessions existed, when they were established, and what was exchanged.