To find out which service or program using a port on a Linux machine, you can use the command
fuser -vn tcp PORT_HERE
Example
root@sok-01:~# fuser -vn tcp 80
USER PID ACCESS COMMAND
80/tcp: root 1144 F.... nginx
boby 1145 F.... nginx
boby 1146 F.... nginx
boby 1147 F.... nginx
boby 1148 F.... nginx
root@sok-01:~#
In this case, TCP port 80 is used by a process with PID 1144, that is Nginx. This process has multiple subprocesses with PID 1145, 1146, 1147, and 1148.
You can also use
root@sok-01:~# fuser 80/tcp 80/tcp: 1144 1145 1146 1147 1148 root@sok-01:~#
This just lists all process IDs. You can find the process by looking at the result of “ps aux” command and finding the process with the above process ids.
Using netstat
Another method is to use “netstat -lntp” command
root@sok-01:~# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 913/cupsd tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 1144/nginx: master tcp 0 0 127.0.0.1:5982 0.0.0.0:* LISTEN 22719/VBoxHeadless tcp 0 0 0.0.0.0:7070 0.0.0.0:* LISTEN 1036/anydesk tcp 0 0 127.0.0.1:7878 0.0.0.0:* LISTEN 2969/ssh tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1118/mysqld tcp 0 0 127.0.0.1:2222 0.0.0.0:* LISTEN 22719/VBoxHeadless tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/init tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1144/nginx: master tcp 0 0 10.42.0.1:53 0.0.0.0:* LISTEN 26291/dnsmasq tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1532/dnsmasq tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 856/systemd-resolve tcp6 0 0 ::1:631 :::* LISTEN 913/cupsd tcp6 0 0 ::1:7878 :::* LISTEN 2969/ssh tcp6 0 0 :::5900 :::* LISTEN 22719/VBoxHeadless tcp6 0 0 :::111 :::* LISTEN 1/init root@sok-01:~#
This lists all listening ports. The last column shows PID/Program name. To find a specific port, you can use grep
root@sok-01:~# netstat -lntp | grep 80 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1144/nginx: master root@sok-01:~#
In the above command, we find which program uses port 80.
Leave a Reply