How to Quickly Identify Port Usage on Linux with netstat, ss, lsof, fuser & nmap

Using netstat or ss

Both netstat and ss can display active sockets. Install the required tools if missing (e.g., yum install -y net-tools for netstat). netstat -anlp | grep 8888 Key flags:

-t : show TCP ports

-u : show UDP ports

-l : list only listening sockets

-p : display PID and program name

-n : show numeric addresses (skip DNS lookup)

The output columns are:

Proto : protocol (tcp/udp)

Recv‑Q : bytes waiting to be read by the process

Send‑Q : bytes waiting to be sent

Local Address : IP and port the socket is bound to (e.g., 0.0.0.0:22 for all IPv4 interfaces, :::22 for IPv6, 127.0.0.1:9100 for loopback only)

Foreign Address : remote endpoint (if applicable)

State : connection state such as LISTEN, ESTABLISHED, UNKNOWN

PID/Program : owning process ID and executable name

Using lsof

The lsof command lists open files, including network sockets. lsof -i:80 Install it if necessary with yum install -y lsof. The output shows which processes have files or sockets bound to the specified port.

Using fuser

fuser

works in the opposite direction: it tells you which process is using a given file or socket. fuser 22/tcp -v Install with yum install -y psmisc. This is useful for quickly identifying the PID that holds a particular port.

Using nmap

nmap

is a network scanner that can also probe the local host. nmap localhost Running this command lists open ports on the machine, making it a convenient way to verify which services are reachable.