Blog
Often we need to find out a process or a service running on some port. This is because we have to start a new instance of the same or different service on that port but we cannot until the current process is terminated.
Thus, it is required to find out the PID of a process using its port so that the process can be terminated.
There are many different ways in which a process can be checked using its port and this article will discuss them in detail with example.
Method 1 : Using lsof command
lsof stands for List of open files and can be used to retrieve details of open files on linux. Since a process running on linux is also a file, this command can be used to get the information about a process.
lsof has an -i flag which lists out all the files that are opened by network connections or listening on different ports and returns the name of process, its PID, user who started the process and port number on which the process is running along with other details.
This flag should be followed by a colon and the port number for which you want the process details.
Thus, for finding a process running on port 9090, use the below command
Notice that there should be no space between -i , : and 9090.
It displays the below output
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
app 26549 root 4u IPv6 2427316 0t0 TCP *:9090 (LISTEN)
If lsof is not already installed on your system, then install it using apt or yum as shown below
# use apt
sudo apt install lsof
# or use yum
sudo yum install lsof
Method 2 : Using netstat command
netstat stands for Network Statistics and is a utility for displaying information about network and related details over TCP/IP protocol. This utility is available in Windows, Linux and Mac operating systems.
In order to view a process running on a particular port, use this command with -l and -p flags along with grep command to filter out unwanted port details.
Here -l flag is used to list out all Listening ports and -p is required for displaying the PID of the process. If you do not want the PID of the processes then omit the -p flag.
Thus, to list out the process details running on port 9090, use the following command
netstat -lp | grep 9090
which prints the below result
where 26549 is the PID of the process running on port 9090.
If you omit the -p flag, the modified output will be
Note that now there is no PID.
If netstat is not already installed on your system, then install it using apt or yum as shown below
# use apt
sudo apt install net-tools
# or use yum
sudo apt install net-tools
Method 3 : Using fuser command
fuser command is used to display details of a process that is using a particular file, folder or socket. As stated earlier, a process in linux is also a file and if you know anything about that process such as its port number(or socket), then fuser can be used to display its details.
To display the details of a process running on port 9090, use the below command.
sudo fuser -v 9090/tcp
where tcp is the protocol on which the process is running and -v flag stands for verbose and it is used to display a detailed output.
Thus, above command will output
If used without -v flag, fuser will only display the PID of the process as shown below
This command also has a -k flag which can be directly used to kill the process that is returned by the command output. Thus, you do not need to explicitly use kill for terminating a process as with other methods stated above.
If fuser is not already installed on your system, then install it using apt or yum as shown below
# use apt
sudo apt install psmisc
# or use yum
sudo yum install psmisc
Method 4 : Using ss command
ss command can also be used to display details about a process. To find out details of a process running on a port, pipe its pipe its output to grep command to show the results of a specific port.
Below command will display the processes listening on a specific port.
sudo ss -ltp | grep 9090
where -l will display listening processes, -t will show only tcp processes and -p will also display the PID of the processes. Output of above command will be
Remember that if you are logged in with root user, then you do not need to add sudo before the command.
Hope this article was useful for you, click the clap below to promote it.
Share if it’s worth .
3 Ways to Find Out Which Process Listening on a Particular Port
A port is a logical entity that represents an endpoint of communication and is associated with a given process or service in an operating system. In previous articles, we explained how to find out the list of all open ports in Linux and how to check if remote ports are reachable using the Netcat command.
In this short guide, we will show different ways of finding the process/service listening on a particular port in Linux.
1. Using netstat Command
netstat (network statistics) command is used to display information concerning network connections, routing tables, interface stats, and beyond. It is available on all Unix-like operating systems including Linux and also on Windows OS.
In case you do not have it installed by default, use the following command to install it.
$ sudo apt-get install net-tools [On Debian/Ubuntu & Mint] $ sudo dnf install net-tools [On CentOS/RHEL/Fedora and Rocky Linux/AlmaLinux] $ pacman -S netstat-nat [On Arch Linux] $ emerge sys-apps/net-tools [On Gentoo] $ sudo dnf install net-tools [On Fedora] $ sudo zypper install net-tools [On openSUSE]
Once installed, you can use it with the grep command to find the process or service listening on a particular port in Linux as follows (specify the port).
In the above command, the flags.
- l – tells netstat to only show listening sockets.
- t – tells it to display tcp connections.
- n – instructs it to show numerical addresses.
- p – enables showing of the process ID and the process name.
- grep -w – shows matching of exact string (:80).
Note: The netstat command is deprecated and replaced by the modern ss command in Linux.
2. Using lsof Command
lsof command (List Open Files) is used to list all open files on a Linux system.
To install it on your system, type the command below.
$ sudo apt-get install lsof [On Debian, Ubuntu and Mint] $ sudo yum install lsof [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux] $ sudo emerge -a sys-apps/lsof [On Gentoo Linux] $ sudo pacman -S lsof [On Arch Linux] $ sudo zypper install lsof [On OpenSUSE]
To find the process/service listening on a particular port, type (specify the port).
3. Using fuser Command
fuser command shows the PIDs of processes using the specified files or file systems in Linux.
You can install it as follows:
$ sudo apt-get install psmisc [On Debian, Ubuntu and Mint] $ sudo yum install psmisc [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux] $ sudo emerge -a sys-apps/psmisc [On Gentoo Linux] $ sudo pacman -S psmisc [On Arch Linux] $ sudo zypper install psmisc [On OpenSUSE]
You can find the process/service listening on a particular port by running the command below (specify the port).
Then find the process name using PID number with the ps command like so.
$ ps -p 2053 -o comm= $ ps -p 2381 -o comm=
You can also check out these useful guides about processes in Linux.
You might also like:
That’s all! Do you know of any other ways of finding the process/service listening on a particular port in Linux, let us know via the comment form below.
How to know what program is listening on a given port?
I suspect a program is listening on port 8000 on my machine. When I run the following command, I get this error:
> python -m SimpleHTTPServer # Lots of python error socket.error: [Errno 98] Address already in use If I use another port ( 8000 is the default), the web server runs fine. If I run wget localhost:8000 from the command line, it returns 404 Not Found . What can I do (or what tools are available) to find what program is listening on port 8000 , and from there where that program is configured?
8 Answers 8
Open your terminal and type as
that command will list you the application used by that port with PID. (If no results run via sudo since your might have no permission to certain processes.)
For example, with port 8000 ( python3 -m http.server ):
$ lsof -i :8000 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME python3 3269 user 3u IPv4 1783216 0t0 TCP *:8000 (LISTEN) $ sudo lsof -i :22 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 998 root 3u IPv4 1442116 0t0 TCP *:ssh (LISTEN) sshd 998 root 4u IPv6 1442118 0t0 TCP *:ssh (LISTEN) @Imray the example searches for port 8881. The PID column contains the process IDs and the NAME column contains the ports.
You can use netstat to see which process is listening on which port.
You can use this command to have a full detail :
if you need to know exactly which one is listening on port 8000 you can use this :
sudo netstat -peanut | grep ":8000 " There is no process that can hide from netstat.
To kill/end the process use kill
To expound on the answer by @33833 you can get some very detailed info, for example:
$ lsof -i :8000 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME squid3 1289 proxy 15u IPv6 14810490 0t0 TCP *:8000 (LISTEN) $ ps -fp 1289 UID PID PPID C STIME TTY TIME CMD proxy 1289 1 0 09:48 ? 00:00:00 /usr/sbin/squid3 -N -f /etc/squid-deb-proxy/squid-deb-proxy.conf I can see right there that squid is the process, but it is actualy my squid-deb-proxy that is taking up the port.
Another good example of a java app:
$ lsof -i :4242 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 3075 root 86u IPv4 12019 0t0 TCP *:4242 (LISTEN) $ ps -fp 3075 UID PID PPID C STIME TTY TIME CMD root 3075 1 15 May24 ? 3-16:07:25 /usr/local/crashplan/jre/bin/java -Dfile.encoding=UTF-8 -Dapp=CrashPlanService -DappBaseName=CrashPl You can see in lsof (LiSt Open Files) that it is java, which is less than helpful. Running the ps command with the PID we can see right away that it is CrashPlan.