A port is a logical entity that represents an endpoint of communication and is associated with a given process or service in an operating system. In previous articles, we explained how to find out the list of all open ports in Linux and how to check if remote ports are reachable using the Netcat command.
In this short guide, we will show different ways of finding the process/service listening on a particular port in Linux.
1. Using netstat Command
netstat (network statistics) command is used to display information concerning network connections, routing tables, interface stats, and beyond. It is available on all Unix-like operating systems including Linux and also on Windows OS.
In case you do not have it installed by default, use the following command to install it.
$ sudo apt-get install net-tools [On Debian/Ubuntu & Mint] $ sudo dnf install net-tools [On CentOS/RHEL/Fedora and Rocky Linux/AlmaLinux] $ pacman -S netstat-nat [On Arch Linux] $ emerge sys-apps/net-tools [On Gentoo] $ sudo dnf install net-tools [On Fedora] $ sudo zypper install net-tools [On openSUSE]
Once installed, you can use it with the grep command to find the process or service listening on a particular port in Linux as follows (specify the port).
$ netstat -ltnp | grep -w ':80'
In the above command, the flags.
l– tells netstat to only show listening sockets.t– tells it to display tcp connections.n– instructs it to show numerical addresses.p– enables showing of the process ID and the process name.grep -w– shows matching of exact string (:80).
2. Using lsof Command
lsof command (List Open Files) is used to list all open files on a Linux system.
To install it on your system, type the command below.
$ sudo apt-get install lsof [On Debian, Ubuntu and Mint] $ sudo yum install lsof [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux] $ sudo emerge -a sys-apps/lsof [On Gentoo Linux] $ sudo pacman -S lsof [On Arch Linux] $ sudo zypper install lsof [On OpenSUSE]
To find the process/service listening on a particular port, type (specify the port).
$ lsof -i :80
3. Using fuser Command
fuser command shows the PIDs of processes using the specified files or file systems in Linux.
You can install it as follows:
$ sudo apt-get install psmisc [On Debian, Ubuntu and Mint] $ sudo yum install psmisc [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux] $ sudo emerge -a sys-apps/psmisc [On Gentoo Linux] $ sudo pacman -S psmisc [On Arch Linux] $ sudo zypper install psmisc [On OpenSUSE]
You can find the process/service listening on a particular port by running the command below (specify the port).
$ fuser 80/tcp
Then find the process name using PID number with the ps command like so.
$ ps -p 2053 -o comm= $ ps -p 2381 -o comm=
You can also check out these useful guides about processes in Linux.
That’s all! Do you know of any other ways of finding the process/service listening on a particular port in Linux, let us know via the comment form below.
In the topic, there isn’t a solution to find a kernel-level service/program listening to a specific port.
In my case, it was a wireguard service like the solution that i have found here https://serverfault.com/questions/1078483/how-to-find-out-what-service-is-listening-on-a-specific-port-of-a-ubuntu-server
There is ss too, like “ss -tlpn port 80“.
-w works with “:::80” but misses “0.0.0.0:80”. Using “:80 “ (with blank) works.
Example:
netstat -ltnp | grep -E ':80 |:443 'The hard way:
on an embedded Linux 2.6 device, with read-only filesystem, without `lsof` or `fuser` binaries, where netstat exists, but ‘-p‘ option is invalid, you can `cat /proc/net/tcp` and see several ‘local_address’ 00000000:####, where #### was the listening port in Hex. In the same row under ‘inode’ column you can see the FD#, and correlate that to /proc//fd/N (each N symlinks to socket:[FD#] or /dev/null).
@Jason
Many thanks for sharing your experience from the embedded Linux side of it.
On my Ubuntu 19.04 I have to use sudo to do “fuser 80/tcp” (I’m not running anything on 80, so I tried ssh, “sudo fuser 22/tcp“). If I run it without sudo – I get no result.