This article will explore ways to check which service is listening on a particular port. Most Linux services run as a daemon exposing a port.
Quick answer: on any modern distribution,
sudo ss -tulpnlists every listening port with the owning process.ssships with iproute2 and is installed by default, whilenetstatis deprecated and usually needs an extra package.
Installing and Using lsof
lsof is a command line utility to list all open files belonging to all active processes.
To install it on Linux, use the following commands depending on the distribution you use.
On Debian, Ubuntu:
sudo apt install lsof
On RHEL, Rocky Linux, AlmaLinux (8 and newer) or Fedora:
sudo dnf install lsof
On older releases such as RHEL 7 or CentOS 7, use yum instead:
sudo yum install lsof
To find which processes are running on which ports, simply specify the port number:
sudo lsof -i :3000
Sample output:
# lsof -i :3000
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
grafana-s 264023 grafana 10u IPv6 2887779 0t0 TCP *:hbci (LISTEN)
Notice that lsof shows the port as hbci, the service name /etc/services assigns to 3000. Add -P to keep port numbers numeric, -n to skip DNS lookups, and -sTCP:LISTEN to show only listening sockets:
sudo lsof -nP -iTCP:3000 -sTCP:LISTEN
For more details, refer man pages.
man lsof
Installing and Using netstat
Netstat is a command line utility used to print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships.
Netstat is part of the net-tools package, which is deprecated in favour of iproute2 (the ss command below) and is no longer installed by default on most distributions. It is still available in the default repositories if you prefer it.
To install it on Linux and its variants, do:
On RHEL, Rocky Linux, AlmaLinux (8 and newer) or Fedora:
sudo dnf install net-tools
# On older releases such as RHEL 7 or CentOS 7
sudo yum install net-tools
On Debian, Ubuntu:
sudo apt install net-tools
Use the following command to find which services are listening on what ports:
sudo netstat -tulpn
Sample output:
# sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:8088 0.0.0.0:* LISTEN 538847/influxd
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 900/nginx: master p
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd
tcp 0 0 0.0.0.0:7088 0.0.0.0:* LISTEN 538639/docker-proxy
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 900/nginx: master p
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 970/sshd
tcp6 0 0 :::9080 :::* LISTEN 393063/promtail-lin
tcp6 0 0 :::3000 :::* LISTEN 264023/grafana-serv
tcp6 0 0 :::3100 :::* LISTEN 391839/loki-linux-a
tcp6 0 0 :::9090 :::* LISTEN 263154/prometheus
tcp6 0 0 :::9096 :::* LISTEN 391839/loki-linux-a
tcp6 0 0 :::9100 :::* LISTEN 262769/node_exporte
tcp6 0 0 :::44303 :::* LISTEN 393063/promtail-lin
tcp6 0 0 :::111 :::* LISTEN 1/systemd
tcp6 0 0 :::7088 :::* LISTEN 538645/docker-proxy
tcp6 0 0 :::80 :::* LISTEN 900/nginx: master p
tcp6 0 0 :::8086 :::* LISTEN 538847/influxd
tcp6 0 0 :::22 :::* LISTEN 970/sshd
udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd
udp 0 0 127.0.0.1:323 0.0.0.0:* 777/chronyd
udp6 0 0 :::111 :::* 1/systemd
udp6 0 0 ::1:323 :::* 777/chronyd
udp6 0 0 fe80::458:3aff:fed6:546 :::* 850/NetworkManager
If you are interested in any specific port, you can use grep to filter:
sudo netstat -tulpn | grep 3000
sudo netstat -tulpn | grep grafana
Flags:
- -t flag shows tcp connections.
- -u flag shows udp connections.
- -l flag displays listening sockets.
- -p flag displays the process ID(PID) and the process name of whatever is using that port.
- -n flag displays the numerical addresses.
For more details, refer man pages.
man netstat
Using the ss Command
ss is a command line utility to investigate sockets. It is the modern replacement for netstat and its usage is almost the same as netstat. It is part of the iproute2 package, which comes pre-installed on popular Linux distros like Red Hat, Debian and their variants.
To find which services are listening on which ports, run:
sudo ss -tulpn
Sample output:
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 0.0.0.0:111 0.0.0.0:* users:(("rpcbind",pid=705,fd=5),("systemd",pid=1,fd=33))
udp UNCONN 0 0 127.0.0.1:323 0.0.0.0:* users:(("chronyd",pid=777,fd=6))
udp UNCONN 0 0 [::]:111 [::]:* users:(("rpcbind",pid=705,fd=7),("systemd",pid=1,fd=35))
udp UNCONN 0 0 [::1]:323 [::]:* users:(("chronyd",pid=777,fd=7))
udp UNCONN 0 0 [fe80::458:3aff:fed6:8255]%eth0:546 [::]:* users:(("NetworkManager",pid=850,fd=26))
tcp LISTEN 0 128 127.0.0.1:8088 0.0.0.0:* users:(("influxd",pid=538847,fd=3))
tcp LISTEN 0 128 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=902,fd=8),("nginx",pid=901,fd=8),("nginx",pid=900,fd=8))
tcp LISTEN 0 128 0.0.0.0:111 0.0.0.0:* users:(("rpcbind",pid=705,fd=4),("systemd",pid=1,fd=32))
tcp LISTEN 0 128 0.0.0.0:7088 0.0.0.0:* users:(("docker-proxy",pid=538639,fd=4))
tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=902,fd=9),("nginx",pid=901,fd=9),("nginx",pid=900,fd=9))
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=970,fd=5))
tcp LISTEN 0 128 *:9080 *:* users:(("promtail-linux-",pid=393063,fd=10))
tcp LISTEN 0 128 *:3000 *:* users:(("grafana-server",pid=264023,fd=10))
tcp LISTEN 0 128 *:3100 *:* users:(("loki-linux-amd6",pid=391839,fd=9))
tcp LISTEN 0 128 *:9090 *:* users:(("prometheus",pid=263154,fd=8))
tcp LISTEN 0 128 *:9096 *:* users:(("loki-linux-amd6",pid=391839,fd=10))
tcp LISTEN 0 128 *:9100 *:* users:(("node_exporter",pid=262769,fd=3))
tcp LISTEN 0 128 *:44303 *:* users:(("promtail-linux-",pid=393063,fd=11))
tcp LISTEN 0 128 [::]:111 [::]:* users:(("rpcbind",pid=705,fd=6),("systemd",pid=1,fd=34))
tcp LISTEN 0 128 [::]:7088 [::]:* users:(("docker-proxy",pid=538645,fd=4))
tcp LISTEN 0 128 [::]:80 [::]:* users:(("nginx",pid=902,fd=10),("nginx",pid=901,fd=10),("nginx",pid=900,fd=10))
tcp LISTEN 0 128 *:8086 *:* users:(("influxd",pid=538847,fd=5))
tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=970,fd=7))
To filter output for a particular service (E.g. grafana), use:
sudo ss -tulpn | grep grafana
sudo ss -tulpn | grep 3000
ss can also filter by port on its own, which avoids false matches from grep (such as PIDs that happen to contain 3000):
sudo ss -ltnp 'sport = :3000'
For more details, refer man pages.
man ss
Installing and Using fuser command
The commandline utility fuser is also used to identify processes using files or sockets. It displays the PIDs of processes using the specified files or file systems.
It is also available in the default repositories of most Linux distributions.
To install it on Linux, run:
On Debian, Ubuntu:
sudo apt install psmisc
On RHEL, Rocky Linux, AlmaLinux (8 and newer) or Fedora:
sudo dnf install psmisc
# On older releases such as RHEL 7 or CentOS 7
sudo yum install psmisc
We need to find the PID of a service or process listening on a particular port. Let’s check the PID of the process listening on port 3000 using this command:
sudo fuser 3000/tcp
You will see an output like below.
3000/tcp: 264023
Here, 264023 is the PID.
And then find out the actual process using the PID using command:
ps -p 264023 -o comm=
Output
# ps -p 264023 -o comm=
grafana-server
Note: Adding the verbose -v flag allows you to view the complete details in a single command:
sudo fuser -v 3000/tcp
Output:
# sudo fuser -v 3000/tcp
USER PID ACCESS COMMAND
3000/tcp: grafana 264023 F.... grafana-server
For more details, go through the man pages.
man fuser