How to Quickly Identify Which Process Is Using a Port on Linux

When you encounter the "Address already in use" error, the first troubleshooting step is to determine which ports are currently bound and which processes are listening on them. This guide explains how to use netstat, ss, and lsof to discover listening services on any Linux or Unix‑like system, including macOS.

What Is a Listening Port?

A network port is identified by a number, an associated IP address, and a protocol (TCP or UDP). A listening port is a port on which an application or process is waiting for incoming connections, acting as a communication endpoint. Only one service can listen on the same IP‑port combination; attempting to start another service on that port will fail, as illustrated by the conflict between Apache (ports 80/443) and Nginx.

Using netstat to List Listening Ports

The netstat utility provides network connection information. To display all listening TCP and UDP ports with associated processes, run: sudo netstat -tunlp Key options: -t – show TCP ports -u – show UDP ports -n – display numeric addresses -l – list only listening sockets -p – show PID and program name (requires root)

Typical output includes columns such as Proto, Local Address, and PID/Program name. You can filter the result with grep, e.g., to find the process listening on TCP port 22: sudo netstat -tnlp | grep :22 If the command returns no lines, no process is listening on that port.

Using ss (Socket Statistics)

ss

is a modern replacement for netstat with faster performance and more detailed TCP state information. The syntax is similar: sudo ss -tunlp The output format mirrors netstat, showing state, local address, and the owning process.

Using lsof to Inspect Open Files and Sockets

lsof

lists open files, and because sockets are treated as files in Linux, it can reveal listening ports: sudo lsof -nP -iTCP -sTCP:LISTEN Important options: -n – do not resolve hostnames -P – do not convert port numbers to names -iTCP – limit to TCP sockets -sTCP:LISTEN – show only sockets in LISTEN state

The output includes columns like COMMAND, PID, USER, and NAME (the port). To find the process using MySQL’s default port 3306: sudo lsof -nP -iTCP:3306 -sTCP:LISTEN This will display the mysqld process with its PID.

Summary

By mastering netstat, ss, and lsof, you can quickly locate conflicting services, verify which ports are open, and resolve "Address already in use" errors on Linux and macOS environments.