How to Use the Linux netstat Command to Check Open Ports

The Port Collision Problem

You are a web developer trying to launch a new Node.js application on your Linux server. The application is configured to run on Port 8080. You type the command to start the server, but it instantly crashes, throwing a fatal error: EADDRINUSE: address already in use :::8080.

This error means that another piece of software on your Linux machine is already occupying Port 8080. It is acting like a traffic cop, blocking your new Node.js app from entering the intersection. The problem is, Linux does not automatically tell you which program is hogging the port. It could be an old Apache server you forgot to uninstall, a stray Java process, or a rogue Docker container.

To diagnose this network traffic jam, system administrators use a classic, powerful command-line tool called netstat (Network Statistics). By running netstat with specific flags, you can force Linux to print out a complete list of every single open port on the machine, exactly which application is listening on that port, and the Process ID (PID) of the offending software so you can kill it.

The Standard netstat Command (tulpn)

If you run netstat by itself, it prints out a massive, unreadable list of thousands of active socket connections, which is completely useless for debugging a blocked port.

To get a clean, actionable list of ports that are actively “listening” for incoming traffic, you must combine five specific flags: -tulpn. Because you are querying deep system network information, you must run this with administrator privileges using sudo.

sudo netstat -tulpn

Here is exactly what those letters mean:

• -t (TCP): Show TCP connections (the standard for web traffic).
• -u (UDP): Show UDP connections (used for DNS and streaming).
• -l (Listening): Only show ports that are actively listening for incoming connections (ignore background noise).
• -p (Program): The most important flag. Show the name and Process ID (PID) of the program using the port. (This is why you need sudo).
• -n (Numeric): Show raw IP addresses and port numbers instead of trying to resolve them into domain names (makes the command run instantly).

Reading the Output

When you run sudo netstat -tulpn, a clean table appears.

Look at the column labeled Local Address. You might see an entry like 0.0.0.0:8080. The number after the colon is the port.

Now look at the far right column labeled PID/Program name. Next to your blocked port 8080, you might see 1234/java. This tells you instantly that a Java application with the Process ID 1234 is currently occupying Port 8080.

Filtering the Results with grep

If you are managing a massive server with dozens of services, the -tulpn table can still be quite long. The fastest way to find the culprit is to pipe the output directly into the grep search command.

If you only care about Port 8080, type:

sudo netstat -tulpn | grep 8080

Linux will filter out all the noise and only print the single line showing what is happening on Port 8080.

Resolving the Conflict

Once netstat reveals the offending Process ID (e.g., 1234), you can use the standard Linux kill command to terminate that rogue application and free up the port for your new Node.js server.

sudo kill -9 1234

Stop guessing why your server applications are failing to start. By mastering the sudo netstat -tulpn command, you can instantly peek under the hood of your server’s network stack, identify exactly which programs are hogging your ports, and clear the traffic jam.