How to Check Which Process Is Using a Specific Port on Your System

Identifying which process is using a particular port is important for troubleshooting network issues, freeing up occupied ports, and ensuring system security. This can be achieved using built-in tools like lsof, netstat, ss, or PowerShell commands depending on your operating system. This guide explains step-by-step methods to check port usage on Linux, macOS, and Windows, with best practices for interpreting results and managing processes effectively.

Jul 19, 2025 - 17:28
Updated: 1 month ago
110.5k
How to Check Which Process Is Using a Specific Port on Your System

Quick answer: To find the process using a port, run sudo ss -ltnp 'sport = :8080' or sudo lsof -i :8080 on Linux and macOS, and netstat -aon | findstr :8080 on Windows (then match the PID with tasklist). Each shows the PID and program bound to the port. Once you have the PID you can confirm what it is before deciding whether to stop it. Replace 8080 with the port you are investigating.

Key takeaways

  • Use ss -ltnp 'sport = :8080' on Linux, lsof -i :8080 on macOS, and netstat -aon with tasklist on Windows.
  • Confirm what the PID actually is before killing it, since stopping the wrong process can take down a production service.
  • Prefer reconfiguring the service to another port over killing a process, and run the lookup with sudo or you may see nothing.

A port conflict stops a service from starting, usually with an "address already in use" error. The fix is always the same two steps: find the PID bound to the port, then decide whether to reconfigure or stop that process. Here are the current commands for each operating system.

How do I check which process is using a port on Linux?

Use ss, the modern replacement for netstat. It is installed by default on current distributions.

sudo ss -ltnp 'sport = :8080'

The flags mean listening (-l), TCP (-t), numeric ports (-n) and show the process (-p). A typical line ends with users:(("nginx", pid=2345, fd=6)), so the PID is 2345. For UDP, swap -t for -u.

lsof gives the same answer with the owning user and command name:

sudo lsof -i :8080

If a system still has the legacy net-tools package, netstat works too:

sudo netstat -tulpn | grep :8080

Run these with sudo. Without it, Linux hides the PID and program name for sockets you do not own, which is the most common reason the process column comes back empty.

How do I check which process is using a port on Windows?

Open Command Prompt or PowerShell as Administrator. In Command Prompt, list the port and its PID:

netstat -aon | findstr :8080

The last column is the PID, for example 1234. Turn that into a program name:

tasklist | findstr 1234

PowerShell does both steps at once and is cleaner:

Get-Process -Id (Get-NetTCPConnection -LocalPort 8080).OwningProcess

How do I check which process is using a port on macOS?

lsof is the simplest tool on macOS and behaves the same as on Linux:

sudo lsof -i :3000

The output lists the command, PID and user bound to the port. netstat exists on macOS but no longer maps ports to PIDs cleanly, so prefer lsof here.

Confirm what the process is before you touch it

A PID on its own is not enough. Check the full command line so you do not stop something important:

  • Linux or macOS: ps -p 2345 -o pid, user, comm, args
  • Windows (PowerShell): Get-Process -Id 1234 | Format-List Name, Path, Description

If the program is a database, a system service or something you do not recognise, investigate rather than kill it. A process listening on an unexpected port is worth checking against what you expect to be running.

How do I free a port that is already in use?

You have two choices once you know the owner. The cleaner option is to change the port in the application's own configuration, which avoids repeating the conflict. If you do need to stop the process, do it by PID.

OSGraceful stopForce stop
Linux / macOSkill 2345sudo kill -9 2345
WindowsStop the service or app normallytaskkill /PID 1234 /F

Try the graceful stop first. kill -9 and /F give the program no chance to flush data or close files, so keep them for processes that will not exit any other way, and never use them on a critical service without understanding the consequences.

Common mistakes and quick fixes

  • Empty process column: you forgot sudo (Linux/macOS) or Administrator rights (Windows).
  • Nothing found, but the app still fails: the port may be held on another interface or by IPv6. Drop the filter and scan everything with sudo ss -ltnp or netstat -aon, then read the full list.
  • Port freed but reappears instantly: a service manager such as systemd or a Docker restart policy is relaunching the process. Stop the service or container, not the child PID.
  • Docker binding failures: check the host side with sudo ss -ltnp; a previous container or the Docker proxy often still holds the published port.

Quick command reference

TaskLinux / macOSWindows
Find PID on a portsudo ss -ltnp 'sport = :PORT'netstat -aon | findstr :PORT
Name from PIDps -p PID -o comm, argstasklist | findstr PID
Stop processkill PIDtaskkill /PID PID /F

These few commands cover almost every port conflict you will meet as a developer or administrator. If you want to go deeper into the Linux side, see our guide to process management in Linux and the essential Linux networking commands every administrator should know. Structured practice with these tools is part of a Linux training course if you want a guided path.

Related reading

Frequently Asked Questions

Run sudo ss -ltnp 'sport = :PORT' or sudo lsof -i :PORT. Both show the PID and program bound to the port. Use sudo, otherwise Linux hides the process details for sockets your user does not own and the column comes back blank.

In an Administrator Command Prompt run netstat -aon | findstr :PORT to get the PID, then tasklist | findstr PID for its name. In PowerShell, Get-Process -Id (Get-NetTCPConnection -LocalPort PORT).OwningProcess does both steps at once.

Yes, on modern Linux. ss is faster, installed by default and reads kernel socket data directly, while netstat relies on the older net-tools package that many distributions no longer ship. Both give the PID when run with sufficient privileges.

Almost always a permissions issue. Run the command with sudo on Linux or macOS, or as Administrator on Windows. Without those rights the tools can see the open port but cannot read which process owns it, so the PID and name are hidden.

First identify the owning PID, then either change the port in that application's configuration or stop the process. Try a graceful stop (kill PID) before a forced one (kill -9 or taskkill /F), which gives the program no chance to shut down cleanly.

Use sudo lsof -i :PORT. It lists the command, PID and user bound to the port, exactly like on Linux. On macOS netstat no longer maps ports to PIDs reliably, so lsof is the tool to reach for.

A service manager such as systemd, or a Docker restart policy, is relaunching it automatically. Stop the service or container itself rather than the child PID, otherwise the supervisor simply starts a fresh process on the same port.

What's Your Reaction?

Like Like 0
Dislike Dislike 0
Love Love 0
Funny Funny 0
Wow Wow 0
Sad Sad 0
Angry Angry 0
Vaishnavi

Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.