How to Quickly Identify Which Process Is Using a Port on Linux

Checking Port Usage on Linux

1. netstat or ss commands

Install the required tools if they are missing: yum install -y net-tools Use netstat to display listening sockets and the owning processes: netstat -anlp | grep 8888 Key netstat options:

-t : show TCP ports

-u : show UDP ports

-l : display only listening sockets

-p : show PID and program name

-n : show numeric addresses without DNS lookup

Explanation of the output columns:

Proto : protocol (tcp or udp)

Recv-Q : receive queue size; non‑zero may indicate a DoS attack or backlog

Send-Q : send queue size; non‑zero may indicate slow remote receiver

Local Address : IP and port the socket is bound to (e.g., 0.0.0.0:22, :::22, 127.0.0.1:9100)

Foreign Address : remote endpoint of the connection

State : connection state such as LISTEN, ESTABLISHED, UNKNOWN

PID/Program : process ID and program using the socket

2. ss command

ss

provides similar information with a faster implementation:

ss -anlp | grep 80

3. lsof command

List open files and the processes that own them, including network sockets:

yum install -y lsof

lsof -i:80

4. fuser command

Show which processes are using a specific file or socket. For example, to check port 22:

yum install -y psmisc

fuser 22/tcp -v

5. nmap tool

Scan local ports quickly:

nmap localhost