A service on your system will open a socket in the listen mode to accept network connections from a remote site. The SSHD application does this to listen for SSH connections, http servers do this to accept HTTP requests, and so on.

If your system has been hacked, it might have a new application listening for instructions from its master.

The -l option to ss will list sockets that are open in the listen mode. The -u option specifies to report UDP sockets. A -t option reports TCP sockets.

This command shows a subset of the listening UDP sockets on a Linux workstation:

$ ss -ul
State          Recv-Q  Send-Q      Local Address:Port         Peer Address:Port   
UNCONN         0       0           *:sunrpc                   *:*       
UNCONN         0       0           *:ipp                      *:*       
UNCONN         0       0           *:ntp                      *:*       
UNCONN         0       0           127.0.0.1:766              *:*       
UNCONN         0       0           *:898                      *:*       

This output shows that this system will accept Remote Procedure Calls (sunrpc). This port is used by the portmap program. The portmap program controls access to the RPC services and is used by the nfs client and server.

The ipp and ntp ports are used for Internet Printing Protocol and Network Time Protocol. Both are useful tools, but may not be required on a given system.

Ports 766 and 898 are not listed in /etc/services. The -I option of the lsof command will display the task that has a port open. You may need to have root access to view this:

    # lsof -I :898

Or:

    # lsof -n -I :898
    COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    rpcbind 3267  rpc    7u  IPv4  16584      0t0  UDP *:898 
    rpcbind 3267  rpc   10u  IPv6  16589      0t0  UDP *:898 

This command shows that the tasks listening on port 898 are part of the RPC system, not a hacker.