How to Quickly Identify Which Process Is Using a Port on Linux

Overview

The article explains practical ways to check which ports are in use on a Linux system and to identify the processes that own them, using common command‑line tools. It also notes the required packages for each command.

1. Using netstat or ss

Install the net-tools package if netstat is missing: yum install -y net-tools Typical command: netstat -anlp | grep 8888 Key options: -t: show TCP ports -u: show UDP ports -l: display only listening sockets -p: show PID and program name -n: show numeric addresses without DNS lookup

Explanation of the columns in the output:

Proto : protocol (tcp or udp)

Recv‑Q : bytes waiting to be read by the process; non‑zero may indicate a DoS attack or backlog

Send‑Q : bytes waiting to be sent; non‑zero can mean the remote side is slow

Local Address : IP and port the socket is bound to (e.g., 0.0.0.0:22 for all IPv4 interfaces, :::22 for all IPv6, 127.0.0.1:9100 for loopback only)

Foreign Address : remote endpoint of the connection

State : connection state (e.g., LISTEN, ESTABLISHED, UNKNOWN)

PID/Program : process ID and executable name using the socket

Example of state values:

LISTEN: waiting for incoming connections
ESTABLISHED: active data exchange
UNKNOWN: unrecognised state

Alternative with ss (part of iproute2, usually pre‑installed):

ss -anlp | grep 80

2. Using lsof

lsof

lists open files, including network sockets. Install it if necessary: yum install -y lsof Command to find processes using a specific port (e.g., 80):

lsof -i:80

3. Using fuser

fuser

shows which processes are using a file or socket. Install the psmisc package if needed: yum install -y psmisc Example to check who is using TCP port 22:

fuser 22/tcp -v

4. Scanning with nmap

nmap

can quickly scan local ports: nmap localhost This command lists open ports on the host, making it convenient for a quick overview.