3 Ways to Find Out Which Process Listening on a Particular Port

A port is a logical entity that represents an endpoint of communication and is associated with a given process or service in an operating system. In previous articles, we explained how to find out the list of all open ports in Linux and how to check if remote ports are reachable using the Netcat command.

In this short guide, we will show different ways of finding the process/service listening on a particular port in Linux.

1. Using netstat Command

netstat (network statistics) command is used to display information concerning network connections, routing tables, interface stats, and beyond. It is available on all Unix-like operating systems including Linux and also on Windows OS.

In case you do not have it installed by default, use the following command to install it.

$ sudo apt-get install net-tools    [On Debian/Ubuntu & Mint] 
$ sudo dnf install net-tools        [On CentOS/RHEL/Fedora and Rocky Linux/AlmaLinux]
$ pacman -S netstat-nat             [On Arch Linux]
$ emerge sys-apps/net-tools         [On Gentoo]
$ sudo dnf install net-tools        [On Fedora]
$ sudo zypper install net-tools     [On openSUSE]

Once installed, you can use it with the grep command to find the process or service listening on a particular port in Linux as follows (specify the port).

$ netstat -ltnp | grep -w ':80' 
Check Port Using netstat Command
Check Port Using netstat Command

In the above command, the flags.

  • l – tells netstat to only show listening sockets.
  • t – tells it to display tcp connections.
  • n – instructs it to show numerical addresses.
  • p – enables showing of the process ID and the process name.
  • grep -w – shows matching of exact string (:80).
Note: The netstat command is deprecated and replaced by the modern ss command in Linux.

2. Using lsof Command

lsof command (List Open Files) is used to list all open files on a Linux system.

To install it on your system, type the command below.

$ sudo apt-get install lsof     [On Debian, Ubuntu and Mint]
$ sudo yum install lsof         [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux]
$ sudo emerge -a sys-apps/lsof  [On Gentoo Linux]
$ sudo pacman -S lsof           [On Arch Linux]
$ sudo zypper install lsof      [On OpenSUSE]    

To find the process/service listening on a particular port, type (specify the port).

$ lsof -i :80
Find Port Using lsof Command
Find Port Using lsof Command

3. Using fuser Command

fuser command shows the PIDs of processes using the specified files or file systems in Linux.

You can install it as follows:

$ sudo apt-get install psmisc     [On Debian, Ubuntu and Mint]
$ sudo yum install psmisc         [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux]
$ sudo emerge -a sys-apps/psmisc  [On Gentoo Linux]
$ sudo pacman -S psmisc           [On Arch Linux]
$ sudo zypper install psmisc      [On OpenSUSE]    

You can find the process/service listening on a particular port by running the command below (specify the port).

$ fuser 80/tcp

Then find the process name using PID number with the ps command like so.

$ ps -p 2053 -o comm=
$ ps -p 2381 -o comm=
Find Port and Process ID in Linux
Find Port and Process ID in Linux

You can also check out these useful guides about processes in Linux.

That’s all! Do you know of any other ways of finding the process/service listening on a particular port in Linux, let us know via the comment form below.

Aaron Kili
Aaron Kili is a Linux and F.O.S.S enthusiast, an upcoming Linux SysAdmin, web developer, and currently a content creator for TecMint who loves working with computers and strongly believes in sharing knowledge.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.

6 thoughts on “3 Ways to Find Out Which Process Listening on a Particular Port”

  1. -w works with “:::80” but misses “0.0.0.0:80”. Using “:80 “ (with blank) works.

    Example: netstat -ltnp | grep -E ':80 |:443 '

    Reply
  2. The hard way:

    on an embedded Linux 2.6 device, with read-only filesystem, without `lsof` or `fuser` binaries, where netstat exists, but ‘-p‘ option is invalid, you can `cat /proc/net/tcp` and see several ‘local_address’ 00000000:####, where #### was the listening port in Hex. In the same row under ‘inode’ column you can see the FD#, and correlate that to /proc//fd/N (each N symlinks to socket:[FD#] or /dev/null).

    Reply
  3. On my Ubuntu 19.04 I have to use sudo to do “fuser 80/tcp” (I’m not running anything on 80, so I tried ssh, “sudo fuser 22/tcp“). If I run it without sudo – I get no result.

    Reply

Got something to say? Join the discussion.

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.