Read the endpoint before guessing a service A listener waits for incoming traffic at an endpoint. Keep an address, port and transport when identifying an endpoint; these shortened rows assume one host and omit its address. TCP and UDP use separate port spaces even when the digits match. A client also has its own port. Dynamic ports range from 49152 through 65535. The later client examples use that range. A customary association such as HTTP with 80/tcp or HTTPS with 443/tcp does not establish an actual listener or protocol. The supplied row is evidence for this card, not a scan or vulnerability. Original fictional listener card. Not output from ss. Worked row Service Listener Name that does not decide the port status page 8081/tcp HTTP is often associated with 80/tcp The client on this row uses 8081. Activity rows Service Listener Note notes page 9090/tcp the stated listener for the page notes datagrams 9090/udp same number, other transport, not the page https customary 443/tcp no row says a listener is here Predict before reading the check. Check: the notes page client uses 9090. Separate row used by the question Service Listener demo HTTP 8080/tcp