sudo ss -tlnp | grep :22

ss -tlnp lists listening (-l) TCP (-t) sockets with process names (-p, hence sudo); grepping for :22 confirms sshd bound to the port after a restart. The output includes the listening address and the owning process — the same check applies to any port when diagnosing 'can't connect'. Compare with ss -tlnp | grep :443 for the web stack.