How to Quickly Identify Which Process Is Using a Port on Linux

Linux Port Usage Inspection

Install required tools if they are missing:

yum install -y net-tools lsof psmisc

1. netstat or ss command

Using netstat: netstat -anlp | grep 8888 Option explanations: -t: show TCP ports -u: show UDP ports -l: display listening sockets only -p: show PID and program name -n: skip DNS resolution for faster output

Key columns in the output:

Proto : protocol (tcp or udp)

Recv‑Q : bytes waiting to be read by the process

Send‑Q : bytes waiting to be sent or acknowledged

Local Address : IP and port on the local machine (e.g., 0.0.0.0:22 for all IPv4, :::22 for all IPv6, 127.0.0.1:9100 for loopback only)

Foreign Address : remote IP and port

State : connection state such as LISTEN, ESTABLISHED, UNKNOWN

PID/Program : owning process ID and name

Typical state values:

LISTEN: listening for incoming connections
ESTABLISHED: active data exchange
UNKNOWN: unrecognized socket state

2. ss command

Alternative to netstat:

ss -anlp | grep 80

3. lsof command

Lists open files and the processes that own them, useful for ports:

lsof -i:80

4. fuser command

Shows which process is using a specific file or socket (ports are treated as files):

fuser 22/tcp -v

5. nmap tool

Scans local ports quickly:

nmap localhost