After gaining a low-privilege shell on a Linux web server, a penetration tester wants to identify locally running network services and internal listening ports that are not exposed externally, in order to plan lateral movement. Which command provides the most relevant information for this specific goal?