4 Ways to Find Out Which Process Listening on a Particular Port

In this article, you will learn how to find which process or service is listening on a particular port in Linux using ss, netstat, lsof, and fuser commands.

A port is a logical entity that represents an endpoint of communication and is associated with a given process or service in an operating system.

In previous articles, we explained how to find out the list of all open ports in Linux and how to check if remote ports are reachable using the Netcat command.

1. Using ss Command

The ss (socket statistics) command is the modern replacement for netstat and comes pre-installed on most Linux distributions. It’s faster and provides more detailed information about network connections.

To find which process is listening on a particular port, use:

ss -ltnp | grep -w ':80'

Sample Output:

LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=2053,fd=6))

The command flags mean:

• l – show only listening sockets.
• t – display TCP connections.
• n – show numerical addresses (don’t resolve hostnames).
• p – show process information.
• grep -w – match exact string (:80).

You can also check all processes listening on a specific port range:

ss -ltnp | grep -E ':(80|443)'

Or find which process is using a specific port with the process name:

ss -ltnp 'sport = :80'

2. Using netstat Command

The netstat (network statistics) command is the traditional tool for displaying network connections. While it’s deprecated in favor of ss, it’s still widely used and available on most systems.

In case you don’t have it installed, use the following command:

sudo apt install net-tools        [On Debian/Ubuntu & Mint] 
sudo dnf install net-tools        [On CentOS/RHEL/Fedora and Rocky/AlmaLinux]
pacman -S net-tools               [On Arch Linux]
emerge sys-apps/net-tools         [On Gentoo]
sudo zypper install net-tools     [On openSUSE]

Once installed, you can use it with the grep command to find the process or service listening on a particular port in Linux as follows (specify the port).

netstat -ltnp | grep -w ':80' 

The command flags are:

• l – tells netstat to only show listening sockets.
• t – tells it to display tcp connections.
• n – instructs it to show numerical addresses.
• p – enables showing of the process ID and the process name.
• grep -w – shows matching of exact string (:80).

To check both TCP and UDP ports:

netstat -tulpn | grep -w ':53'

3. Using lsof Command

lsof command (List Open Files) is used to list all open files on a Linux system, including network connections.

To install lsof on your system:

sudo apt install lsof             [On Debian/Ubuntu & Mint]
sudo dnf install lsof             [On RHEL/CentOS/Fedora and Rocky/AlmaLinux]
sudo emerge -a sys-apps/lsof      [On Gentoo]
sudo pacman -S lsof               [On Arch Linux]
sudo zypper install lsof          [On openSUSE]  

To find the process/service listening on a particular port, type (specify the port).

sudo lsof -i :80

To check a specific protocol (TCP or UDP):

sudo lsof -i tcp:80
sudo lsof -i udp:53

To find all listening ports by a specific process:

sudo lsof -i -P -n | grep nginx

The flags mean:

• -i – list network files.
• -P – show port numbers (don’t convert to port names).
• -n – show IP addresses (don’t resolve to hostnames).

4. Using fuser Command

The fuser command identifies processes using files or sockets and is part of the psmisc package.

You can install it as follows:

sudo apt install psmisc           [On Debian/Ubuntu & Mint]
sudo dnf install psmisc           [On RHEL/CentOS/Fedora and Rocky/AlmaLinux]
sudo emerge -a sys-apps/psmisc    [On Gentoo]
sudo pacman -S psmisc             [On Arch Linux]
sudo zypper install psmisc        [On openSUSE]  

You can find the process/service listening on a particular port by running the command below (specify the port).

sudo fuser 80/tcp

Then find the process name using PID number with the ps command like so.

ps -p 2053 -o comm=
ps -p 2381 -o comm=

Bonus: Using systemctl for Service Ports

If you’re running systemd-based distributions, you can check which service is configured to use a particular port:

sudo systemctl status nginx

This shows the service status and which ports it’s configured to use, though it doesn’t directly query by port number.

Quick Comparison of Tools

Quick Comparison of Tools

Common Use Cases

Check if a port is already in use before starting a service:

ss -ltn | grep -w ':8080'

Find all processes listening on privileged ports (1-1024):

sudo ss -ltnp | awk '$4 ~ /:([0-9]{1,3}|10[0-2][0-4])$/ {print}'

Check which process is blocking your application’s port:

sudo lsof -i :3000

Verify web server is listening on correct ports:

ss -ltnp | grep -E ':(80|443)'

Related Articles

You can also check out these useful guides about processes in Linux.

That’s all! Do you know of any other ways of finding the process/service listening on a particular port in Linux, let us know via the comment form below.