Which Linux command could a systems administrator use to determine if an attacker had opened up a new listening port on her system?

nfsstat reports statistics specifically about the NFS (Network File System) protocol and does not display general listening ports or TCP/UDP socket state.

netreport is not a standard Linux networking utility and is not used to enumerate listening ports or active connections.

ps displays running processes and their attributes but does not show network socket state or which ports are open and listening.

netstat (network statistics) lists all current TCP/UDP connections, listening sockets, and the associated process IDs, allowing an administrator to compare the current port state against a known-good baseline. Running 'netstat -tulnp' shows all listening ports with the owning process, which directly reveals any attacker-introduced listeners. This makes it the standard tool for network-level host auditing.

vrnstat is not a recognized Linux command and does not exist as a standard networking diagnostic tool.