Let’s find out which process is listening on a particular port. We’ll use three different ways to inspect and find the process/service listening on a particular port in Linux.
1. netstat
First, we’re going to use netstat which is used to display information regarding network conns, interface stats, and beyond. netstat comes pre-installed in Linux and also on Windows operating system.
$ sudo apt-get install net-tools [On Debian/Ubuntu & Mint] $ sudo dnf install net-tools [On CentOS/RHEL/Fedora and Rocky Linux/AlmaLinux] $ pacman -S netstat-nat [On Arch Linux] $ emerge sys-apps/net-tools [On Gentoo] $ sudo dnf install net-tools [On Fedora] $ sudo zypper install net-tools [On openSUSE]
You can use netstat command to output every little details but along with netstat you can use grep to narrow down your specific thing which you’re looking for.
$ netstat -ltnp | grep -w ':443'
l– tells netstat to only show listening sockets.t– tells it to display tcp connections.n– instructs it to show numerical addresses.p– enables showing of the process ID and the process name.grep -w– shows matching of exact string (:80).
2. lsof
Second, we can use lsof to filter out specific ports and find out which services are running behind the particular port.
To install on your Linux system:
$ sudo apt-get install lsof [On Debian, Ubuntu and Mint] $ sudo yum install lsof [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux] $ sudo emerge -a sys-apps/lsof [On Gentoo Linux] $ sudo pacman -S lsof [On Arch Linux] $ sudo zypper install lsof [On OpenSUSE]
To find the particular port you can use these arguments,
$ lsof -i :443
3. fuser
Lastly, we can use fuser, which will output PIDs of processes,
Let’s install fuser on Linux:
$ sudo apt-get install psmisc [On Debian, Ubuntu and Mint] $ sudo yum install psmisc [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux] $ sudo emerge -a sys-apps/psmisc [On Gentoo Linux] $ sudo pacman -S psmisc [On Arch Linux] $ sudo zypper install psmisc [On OpenSUSE]
To find out which service is running or listening on a particular port we can use this,
$ fuser 443/tcp
In case you want to inspect running process name using PID numbers you can use ps command,
$ ps -p 1337 -o comm=
