3 ways to find Which Process Listening on a Particular Port in Linux

In Linux, there are several commands that can be used to find the process name associated with a specific port number. The most commonly used commands for this purpose are netstat, ss, and lsof.

The netstat command provides information about network connections and open ports on a Linux system.

The ss command is similar to netstat, but is more modern and provides faster and more detailed information about network connections.

The lsof command lists all open files on a system, including network sockets. By using the -i option with lsof, you can filter the output to display only open files associated with a specific port number.

In this article, we will dive into these commands. Let’s get started!

Using the netstat Command to Identify Processes Listening on a Specific Port in Linux

Netstat (network statistics) is a command-line tool used in Linux and other Unix-like operating systems to display various network-related information.

The netstat command can be used to display information such as active network connections, network statistics, open ports, and the status of network interfaces.

To get the process name based on port number in Linux using the netstat command, you can follow these steps:

1. First, use the netstat command to view all network connections and ports on the system.
2. Use the grep command to filter the output based on the port number you are interested in.
3. Use the awk command to print the process ID (PID) associated with the port number.
4. Finally, use the ps command to find the process name associated with the PID.

Here is an example command to get the process name based on a port number (replace port_number with the actual port number you want to search for):

sudo netstat -tulpn | grep port_number | awk '{print $7}' | cut -d/ -f1 | xargs -I{} ps -p {} -o comm=

For example, if you need to get the process name which is listening on port 22, you can run the following command

sudo netstat -tulpn | grep :22 | awk '{print $7}' | cut -d/ -f1 | xargs -I{} ps -p {} -o comm=
sshd

Find process name based on port number with ss command in Linux

To get the process name and ID associated with a particular port number in Linux, you can use the ss command with the -tulpn options.

• The -t option tells ss to display TCP sockets,
• the -u option tells it to display UDP sockets,
• the -l option tells it to display listening sockets only,
• the -p option tells it to display the process ID and name associated with each socket, and
• the -n option tells it to display numerical addresses rather than trying to resolve them to hostnames.

Here’s an example:

$ ss -tulpn | grep :80
tcp LISTEN 0 128 *:80 *:*
users:(("httpd",pid=2867,fd=4),("httpd",pid=2866,fd=4),("httpd",pid=2865,fd=4),("httpd",pid=2864,fd=4),("httpd",pid=2863,fd=4),("httpd",pid=2862,fd=4),("httpd",pid=2861,fd=4)))

In this example, the ss command is displaying all TCP and UDP sockets that are in the listening state and shows the process ID and name associated with each socket.

The output is then piped to grep and filtered to show only lines that contain :80, which is the port number we’re interested in.

The output shows that the process name is httpd and there are several instances of it running, each with a different process ID.

You can use a similar command to find the process name and ID associated with any port number you’re interested in.

Just replace :80 with the desired port number in the grep command.

For example, to find the process name and ID associated with port number 443 (the default port for HTTPS), you would use the following command:

$ ss -tulpn | grep :443

How to Use the lsof Command to Find Out Which Process is Using a Specific Port in Linux

To use the lsof command to get the process name that is utilizing a specific port number in Linux, you can run the following command: lsof -i :[port_number], replacing [port_number] with the actual port number.

This will display a list of processes which have connections open to that specific port. You can then identify the process names from this output.

For example, if we need to find the process name running on port 8080, we can use the following command.

lsof -i :8080

This will display a list of all processes that have a network connection open on port 8080. The output will include the process ID (PID), the process name (COMMAND), and the user that owns the process (USER).

Here’s an example of the output you might see:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 12345 user1 123u IPv4 12345 0t0 TCP *:8080 (LISTEN)

In this example, the process associated with port 8080 is a Java process with a PID of 12345 and is owned by user “user1”. The process is in a listening state, indicated by the (LISTEN) at the end of the line.

The -n option in lsof tells the command displays network addresses as numbers instead of hostnames.

For example, to find the process associated with port 8080, you could use the following command:

lsof -n -i:8080

Here is another example to list all processes using the 5432 port (commonly used by postgres)

lsof -i :5432
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
postgres 777 1ma 7u IPv6 0x0123456789abcdef 0t0 TCP localhost:postgresql (LISTEN)
postgres 777 1ma 8u IPv4 0x1123456789abcdef 0t0 TCP localhost:postgresql (LISTEN)