How to Find Which Process is Listening on a Port in Linux

When managing a Linux server or troubleshooting network issues, you will often need to find out which application or service is listening on a specific network port. For example, if you are trying to start a web server on port 80 but receive a “port already in use” error, you must identify the conflicting process before you can resolve the issue.

In this guide, we will explore the most reliable command-line tools available in Linux to help you find which process is listening on a port, including lsof, ss, and netstat.

Method 1: Finding a Listening Process Using lsof

The lsof (List Open Files) command is one of the most straightforward and commonly used tools for identifying which process is attached to a specific port. Because Linux treats everything as a file, including network sockets, lsof is perfectly suited for this task.

To find the process listening on a specific port (for example, port 80), open your terminal and run the following command:

sudo lsof -i :80

Note: You must run this command with sudo or as the root user. If you run it as a standard user, lsof will only display processes owned by your user account, which means you might miss system-level services.

The output will display several columns of information, but the most important ones are:

• COMMAND: The name of the process (e.g., apache2, nginx, sshd).
• PID: The Process ID, which you will need if you want to stop or kill the service.
• USER: The user account running the process.

Method 2: Identifying Listening Ports Using ss

The ss command is a modern, faster replacement for the older netstat utility. It directly queries the kernel for network socket information, making it extremely efficient on busy servers.

To view all listening TCP and UDP ports along with the processes using them, use the following combination of flags:

sudo ss -tulpn

Here is what the flags mean:

• -t: Show TCP sockets.
• -u: Show UDP sockets.
• -l: Show only listening sockets.
• -p: Show the process using the socket.
• -n: Do not resolve service names (display numerical port numbers instead).

If you want to search for a specific port (e.g., port 22), you can pipe the output into the grep command:

sudo ss -tulpn | grep :22

Method 3: Checking Ports Using netstat

Although netstat is considered deprecated in many modern Linux distributions (having been replaced by ss), it is still widely installed and heavily used by system administrators.

You can use netstat with almost identical flags to ss to find the process ID (PID) attached to a port:

sudo netstat -tulpn

Look at the final column in the output, labelled PID/Program name, to identify exactly what is running on each port.

How to Kill a Process Blocking a Port

Once you have identified the Process ID (PID) of the application listening on the port, you can stop it if necessary. If the process is a managed system service, it is best to stop it gracefully using systemctl. For example, if you discover that Nginx is occupying the port, run:

sudo systemctl stop nginx

If the process is a standalone script or unresponsive application, you can forcefully terminate it using the kill command followed by the PID you found earlier. For example, if the PID is 1453:

sudo kill -9 1453

By mastering these commands, you can quickly identify port conflicts, secure your server by tracking down unexpected network activity, and manage your Linux networking environment with confidence.