Linux: Which process is using a port

The most portable way to find out which process is using a port on Linux and other Unixes is to use the fuser command.

Note: for privileged ports (1-1023), you'll need to run these commands as a root.

To find out which process is using TCP port 80, we can do something like this:

fuser 80/tcp

By default fuser will only give us a list of PIDs, e.g.:

80/tcp:               1139  1143  1145  1146  1147

But we can get more info by using its verbose mode - fuser -v 80/tcp:

                     USER        PID ACCESS COMMAND
80/tcp:              root       1139 F.... nginx
                     www-data   1143 F.... nginx
                     www-data   1145 F.... nginx
                     www-data   1146 F.... nginx
                     www-data   1147 F.... nginx

Alternatives:

lsof

To get more info (at the expense of portability), we can use lsof:

lsof -i tcp:80

If we are interested both in TCP and UDP connections, we can leave out the prefix:

lsof -i :80

The result in this case (with nginx running on the port 80) should look something like this:

COMMAND    PID     USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
nginx     1139     root    5u  IPv4   16884      0t0  TCP *:http (LISTEN)
nginx     1139     root    6u  IPv6   16885      0t0  TCP *:http (LISTEN)
nginx     1143 www-data    5u  IPv4   16884      0t0  TCP *:http (LISTEN)
nginx     1143 www-data    6u  IPv6   16885      0t0  TCP *:http (LISTEN)
nginx     1145 www-data    4u  IPv6 9115409      0t0  TCP localhost:http->localhost:50642 (ESTABLISHED)
nginx     1145 www-data    5u  IPv4   16884      0t0  TCP *:http (LISTEN)
nginx     1145 www-data    6u  IPv6   16885      0t0  TCP *:http (LISTEN)
nginx     1146 www-data    5u  IPv4   16884      0t0  TCP *:http (LISTEN)
nginx     1146 www-data    6u  IPv6   16885      0t0  TCP *:http (LISTEN)
nginx     1147 www-data    5u  IPv4   16884      0t0  TCP *:http (LISTEN)
nginx     1147 www-data    6u  IPv6   16885      0t0  TCP *:http (LISTEN)
telnet  663099        n    3u  IPv6 9112168      0t0  TCP localhost:50642->localhost:http (ESTABLISHED)

Note: as you can see, this command also gives us the list of processes with established connections (not just processes that are listening on that port).

If we are interested only in listening connections, we can limit that with lsof -i :80 -sTCP:LISTEN:

COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
nginx   1139     root    5u  IPv4  16884      0t0  TCP *:http (LISTEN)
nginx   1139     root    6u  IPv6  16885      0t0  TCP *:http (LISTEN)
nginx   1143 www-data    5u  IPv4  16884      0t0  TCP *:http (LISTEN)
nginx   1143 www-data    6u  IPv6  16885      0t0  TCP *:http (LISTEN)
nginx   1145 www-data    5u  IPv4  16884      0t0  TCP *:http (LISTEN)
nginx   1145 www-data    6u  IPv6  16885      0t0  TCP *:http (LISTEN)
nginx   1146 www-data    5u  IPv4  16884      0t0  TCP *:http (LISTEN)
nginx   1146 www-data    6u  IPv6  16885      0t0  TCP *:http (LISTEN)
nginx   1147 www-data    5u  IPv4  16884      0t0  TCP *:http (LISTEN)
nginx   1147 www-data    6u  IPv6  16885      0t0  TCP *:http (LISTEN)

netstat / ss

Another good alternative is netstat/ss tool.

Since netstat (and the whole net-tools package) is now deprecated, it's recommended to use the replacement ss tool (from the iproute2 package).

For both netstat and ss, we can list all established connections and grep our port:

netstat -tlnup | grep ':80'

ss -tlnup | grep ':80'

With ss, we can do the filtering as a part of the command itself, i.e. to display only connections with source port 80:

ss -tlnup 'sport = :80'

Ask me anything / Suggestions