Find which Process is Listening to a Port

Understanding which process is listening to a particular port on your computer might not be something you think you'll need, but especially when running networking software or doing web development, eventually you'll find that a port is being used, but you don't know by what.

You don't necessarily need to know all the ins and outs of ports and processes to figure this out, but one thing that might be helpful that you should know is that only one process can use a port at a time, which must be reserved. Once the port is reserved, no other programs/processes can use it. If a port is being used and your program tries to open it, you'll get an error.

Now, let's see how to actually figure out which process is listening on which port.

Note: In this article we'll focus on finding which process is listening to a port on Unix-based systems, although some tools, like netstat, are available for Windows systems as well.

Various Methods

Figuring out which process is listening to a specific port is not a one-size-fits-all kind of solution since it's very OS-dependent. Each OS - Windows, Linux, or MacOS - typically have their own tools to help with something like this. While each tool serves the same purpose, they all also come with their own unique features and command syntax.

On Unix-based systems, we typically use tools like netstat, lsof, and ss. netstat is a powerful command-line tool that comes pre-installed with most Linux distributions and provides information about network connections. The lsof command is another powerful tool which means "list of open files". As you can imagine, it gives information about files that are opened by processes. And ss is a modern replacement for netstat that's faster and provides even more information.

For MacOS users, many of the same commands as above will work, in addition to the Network Utility for older MacOS versions, which was a nice built-in tool that provided a good amount of information about network activities.

In the following sections, we'll take a look at the command line tools and how to use them.

Tools

While there are probably others, netstat, lsof, and ss are the three tools we'll be focusing on. With these, you'll be able to see which process is listening on which port.

First up is netstat. You can use it to display active network connections, routing tables, and other network interface and network protocol statistics. It's an excellent starting point for understanding what's happening in your network.

Here's how to use it to find a process listening on a specific port:

$ netstat -tuln | grep :<your-port-number>

Note: Replace <your-port-number> with the number of the port you're interested in. This will show you the process ID (PID) and the name of the process listening to this port.

If we were looking for port 80, we'd see something like this:

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::80                   :::*                    LISTEN      -

Next we'll use lsof. Despite its unassuming name, lsof is a very helpful tool. In Unix/Linux, everything is a file (even network sockets!), and lsof can list all these for you. To find out which process is listening on a particular port, you would use it as follows:

$ sudo lsof -i :<your-port-number>

Here is example output for port 22:

COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    1234   root    3u  IPv4  12345      0t0  TCP *:ssh (LISTEN)

Finally, we have ss, the new kid on the block. ss is intended to be a faster, more informative replacement for netstat. Like netstat, it can display more detailed network statistics. To use ss to identify the process listening on a specific port, you can use the following command:

$ ss -ltpn 'sport = :<your-port-number>'

Using port 5432, we might get an output like this:

State      Recv-Q Send-Q  Local Address:Port   Peer Address:Port              
LISTEN     0      128             *:5432             *:*        users:(("postgres",pid=1234,fd=5))

Again, don't forget to replace <your-port-number> with your actual port number.

Conclusion

Whether you're a network engineer, a developer, or a sysadmin, understanding which process is listening to a particular port can be important. Not only does it help you track network activity, but it also assists in troubleshooting network issues, configuring firewall rules, and running local applications.

In this article we saw how to use command-line tools like netstat, lsof, and ss. While each of these tools has their own unique features and syntax, each can be used for finding which process has reserved a specific port.