Find which process is listening on a port on Linux

Sometimes we need to find out what process is using or listening on a specific port on Linux machine. This can be fairly useful in a production for debugging things. Here are some ways to find process listening on a port on Linux environment. For the purpose of this article we will use Ubuntu Linux.

Use netstat to list all processeses and listening ports

Use netstat with -p (process) option along with -n [–numeric-ports] and -l (listening ports also).

$ sudo netstat -nlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1114/sshd       
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      5212/sendmail: MTA:
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      7597/mysqld
....

The column named “PID/Program Name” contains the process id and name of the program.

In case you want to print full path of the program for a process id you can use the following command:

$ ps -f -p 1114
UID        PID  PPID  C STIME TTY          TIME CMD
root      1114     1  0 Sep02 ?        00:00:01 /usr/sbin/sshd -D

Using lsof to find process from port

command line util lsof is used to list opened file. To list what process are using a specific port, run the following:

$ sudo lsof -i tcp:22

Using fuser to find process from port

fuser can be used to list process listening on a port.

$ sudo fuser -uv 80/tcp
                     USER        PID ACCESS COMMAND
80/tcp:              root      28836 F.... (root)apache2
                     www-data  28841 F.... (www-data)apache2
                     www-data  28842 F.... (www-data)apache2
                     www-data  28844 F.... (www-data)apache2
                     www-data  28845 F.... (www-data)apache2
                     www-data  28848 F.... (www-data)apache2
                     www-data  28878 F.... (www-data)apache2
                     www-data  28906 F.... (www-data)apache2
                     www-data  28907 F.... (www-data)apache2
                     www-data  28908 F.... (www-data)apache2
                     www-data  28909 F.... (www-data)apache2

Here -u is being used to display user also.