Linux: 3 commands to identify the process listening on a particular port

by Tuto Maker - Published 02/08/2022 - Updated 06/09/2024

What's in the box?

In this guide, we teach you 3 different ways to identify the process or service listening on a particular port under Linux. This article focuses on the use of three tools: netstat, lsof and fuser.

A port is a logical element representing a point of communication at machine level, and is associated with a process or service at operating system level. For example, port "80" is associated with the "http" protocol, which corresponds to a Web server, usually Apache or Nginx (and therefore to this process). Without further ado, let's look at several ways of identifying the process associated with a port.

1. Use the netstat (ss) command

Under Linux, the netstat command (network statistics) is used to display information about network connections, routing tables, interface statistics and more. It is available on all Unix operating systems, including Linuxand Windows operating systems, making it a must-have command!

In case it is not installed by default on your machine, use the following command to install it according to your distribution:

# Ubuntu / Debian
sudo apt-get install net-tools
# Rocky Linux / Alma Linux / Fedora / CentOS / RHEL
sudo dnf install net-tools
# Arch Linux
sudo pacman -S netstat-nat [Under Arch Linux]

Once installed, you can use it in combination with the grep command to find the process or service listening on a particular port under Linux. Here's an example with a search on port "80", but you can adapt it to your own port number.

netstat -ltnp | grep -w ':80'

For port 22, generally associated with SSH, this gives :

netstat -ltnp | grep -w ':22'

In the above command, the options are as follows:

l – indique à netstat de n’afficher que les sockets en écoute.
t – lui indique d’afficher les connexions TCP.
n – lui indique d’afficher les adresses numériques.
p – permets d’afficher l’ID du processus et le nom du processus.
grep -w – affiche la correspondance de la chaîne exacte, ici « :80 ».

Although it still works, you should be aware that the netstat command is deprecated and replaced by the ss command under Linux. This new command can be used on the same principle as what we're trying to do today.

In the example below, the "sshd" process can be identified as being associated with port 22 on this machine.

2. Using the lsof command

The lsof command (List Open Files) is used to list all open files on a Linux system. To install it on your system, run the command below corresponding to your distribution (although it may be integrated by default depending on the environment):

# Ubuntu / Debian
sudo apt-get install lsof
# Rocky Linux / Alma Linux / Fedora / CentOS / RHEL
sudo yum install lsof
# Arch Linux
sudo pacman -S lsof [On Arch Linux]

To identify the process or service listening on a particular port, use the syntax below, adapting the port number.

lsof -i :22

3. Using the fuser command

The fuser command displays the PIDs of processes using the specified files under Linux, enabling you to find out which process/service is attached to a port.

You can install it as follows:

# Ubuntu / Debian
sudo apt-get install psmisc
# Rocky Linux / Alma Linux / Fedora / CentOS / RHEL
sudo yum install psmisc
# Arch Linux
sudo pacman -S psmisc

You can identify the process/service listening on a particular port by executing the command below. Here's an example with a search on port 22, in TCP.

fuser 22/tcp

Then, in the command output, retrieve the PID number of the process and retrieve its name with the ps command like this:

ps -p 618 -o comm=

Here's an example:

4. Conclusion

Thanks to this article from the Computer Tutorials box, you will be able toIdentify the process or service behind a listening port on your machine! The netstat (ss) and lsof commands are the most practical, although you can also use fuser as we've just seen.

Resources :