Every open port on a Linux box is tied to some process holding onto it. When something says "address already in use" or you just need to know what's listening on 8080, you need a way to map that port back to a PID and a program name. This guide walks through exactly how to check which process uses a port using tools already on your Linux system.
Syntax
LinuxTeck
Quick Answer:
This shows the process name and PID bound to port 80 in one line, no extra packages needed on most modern distros.
LinuxTeck
How to Install lsof and net-tools in Linux
Most distros ship ss out of the box through iproute2, but lsof, the older netstat, and fuser (from psmisc) usually need a quick install first.
LinuxTeck
sudo apt install lsof net-tools psmisc -y
# RHEL / Rocky Linux / Fedora
sudo dnf install lsof net-tools psmisc -y
# Arch Linux
sudo pacman -S lsof net-tools psmisc
Setting up net-tools (2.10-0.1ubuntu4) ...
Processing triggers for man-db (2.11.2-1) ...
1. List All Listening Ports with ss
Start broad. This dumps every TCP and UDP socket that's actively listening, along with the program and PID behind it. If you're new to socket tools, this is the ss command in its most common form.
LinuxTeck
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=812,fd=3))
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1204,fd=6))
tcp LISTEN 0 128 127.0.0.1:5432 0.0.0.0:* users:(("postgres",pid=955,fd=7))
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* users:(("dhclient",pid=601,fd=6))
TCP sockets
UDP sockets
Listening sockets only
Show process name and PID
Numeric ports, skips DNS lookups
2. Find Which Process Uses a Port with ss
Once you know the port number, filter down instead of scrolling through the whole list.
LinuxTeck
That pid=2871 is what you'd hand off to kill, systemctl, or whatever process manager you're using.
3. Check a Port with lsof
lsof reads it a bit differently, listing open files and treating sockets as files too, which some people find easier to parse at a glance.
LinuxTeck
node 2871 linuxteck 19u IPv4 38421 0t0 TCP *:3000 (LISTEN)
4. Use netstat if It Is Still Installed on Your System
netstat is deprecated in favor of ss on most modern distros, but you'll still run into it on older servers or in scripts nobody's touched in years.
LinuxTeck
5. Match a Port to Its Process ID Quickly
Sometimes you just want the PID by itself, no extra columns to eyeball. lsof has a flag built exactly for this, so you don't need to fight with grep patterns or worry about a header line sneaking into the result.
LinuxTeck
Once you have that number you can cross-check it against ps, or watch it live in htop, to confirm it's actually the process you think it is before you kill anything.
6. Check Only TCP or Only UDP Ports
Splitting the two out helps when you're chasing something like a DNS resolver on UDP 53 without wading through every TCP listener too.
LinuxTeck
udp UNCONN 0 0 0.0.0.0:53 0.0.0.0:* users:(("systemd-resolve",pid=678,fd=13))
7. Find What Is Using a Port on a Specific IP or Interface
On a box with multiple network interfaces, filtering by address instead of grepping the port alone keeps you from matching the wrong service that happens to share the same port number on another interface.
LinuxTeck
8. Kill the Process That Uses a Port with fuser
fuser skips the lookup step entirely, it tells you the PID and can kill it in the same command, which is handy when you already know you want that port freed up right now.
LinuxTeck
Security Warning:
fuser -k kills whatever is bound to that port with no confirmation prompt. Double check the PID with ss or lsof first if it's a production box, you don't want to take down the wrong service on a Friday afternoon. This is exactly the kind of accidental exposure our server hardening checklist covers in more depth.
9. Scan Ports on a Remote Server with nmap
All the tools above run locally on the box. If you need to check what's reachable from outside, that's a different job and nmap is the one for it. Worth doing over an SSH session from a separate box rather than the server itself, so you're seeing what the outside world actually sees.
LinuxTeck
80/tcp open http
443/tcp closed https
3000/tcp filtered unknown
I test this kind of thing a lot on throwaway boxes, usually a cheap Vultr instance since spinning one up takes two minutes and I can tear it down right after. A filtered result there usually points back to a firewall rule rather than the app itself, so that's the next thing to check.
10. Check Port Usage Inside a Docker Container
LinuxTeck
tcp LISTEN 0 128 0.0.0.0:8000 0.0.0.0:* users:(("gunicorn",pid=1,fd=6))
11. The Permission Denied Mistake
Running these commands without sudo is the single most common thing that trips people up. You still get output, it just leaves out the process name and PID, which makes it look broken when it's not.
LinuxTeck
Common Mistake:
Without root privileges, the kernel hides the owning process of sockets you don't own, so on modern kernels the whole process column just disappears instead of an error telling you what went wrong. Add sudo and it fills right back in.
LinuxTeck
Conclusion
ss covers most of this on its own these days, but lsof and fuser are worth knowing when you need a different angle or need to kill and check in one move. If you're troubleshooting connectivity beyond just the local process, our firewalld commands guide and networking cheat sheet are good next stops.
Which of these commands do you reach for first when a port fight breaks out? Share your experience in the comments below.
From your first terminal command to advanced sysadmin skills, every guide here is written in plain English with real examples you can run right now.
Thank you for reading and for being part of this journey. If this article saved you time, consider buying me a coffee. Every contribution helps me keep producing in-depth, practical Linux content for readers like you.
Thank you for your endless support
