Find the Process Using a Port on Linux: lsof, ss, fuser

You start a dev server and get Error: listen EADDRINUSE: address already in use :::3000. Something else already has the port. Here is how to find the process using a port on Linux with three standard tools, then free it up.

Option 1: ss (the modern default)

ss ships with the iproute2 package and replaces the old netstat. This lists every listening TCP and UDP socket with the owning process:

sudo ss -tulpn

The flags mean TCP, UDP, listening, show process, numeric. To focus on one port, filter the output or use ss’s own filter:

sudo ss -tulpn | grep :3000
sudo ss -ltnp 'sport = :3000'

The last column shows something like users:(("node",pid=48213,fd=21)). The number after pid= is the process ID. Use sudo, because without it you only see processes that belong to you.

Option 2: lsof

lsof lists open files, and network sockets count as files. It gives the clearest output of the three:

sudo lsof -i :3000
sudo lsof -nP -iTCP:3000 -sTCP:LISTEN

-i :3000 selects the port, -n and -P skip DNS and service-name lookups so it runs faster, and -sTCP:LISTEN hides established connections so you only see the process that is listening. The output shows the command name, PID and user.

Option 3: fuser

fuser answers one question: which PIDs are using this port?

sudo fuser 3000/tcp

It prints the PID. Add -v for a readable table. Be careful: fuser -k 3000/tcp kills whatever it finds immediately, so check first.

Look up the process

Once you have a PID, find out what it actually is before you stop it:

ps -p 48213 -o pid,user,etime,cmd
ls -l /proc/48213/cwd

The first command shows the user, how long it has been running and the full command line. The second shows the working directory, which often tells you which project started it.

Stop it

1. Try a graceful stop first: kill 48213 sends SIGTERM and lets the program shut down cleanly.
2. If it does not exit after a few seconds, use kill -9 48213. That is SIGKILL and gives the program no chance to clean up.
3. If it is a system service, stop it properly instead: sudo systemctl stop nginx. Otherwise systemd may just restart it.
4. If it is a container, docker ps shows published ports. Stop it with docker stop, because killing the docker-proxy process directly is not the right fix.

Common causes

• A previous run of your dev server that never exited, often hidden in another terminal tab.
• A service already running on the system, such as nginx, Apache or a database.
• A container with the same port published.
• A process stuck in TIME_WAIT. This is normal and clears itself within a minute or so, and most servers can reuse the address with the right socket option.

Ports below 1024

If the error is permission denied instead of address in use, you are probably binding a privileged port (below 1024) as a normal user. Use a higher port, put a reverse proxy in front, or grant the specific binary the right to bind low ports instead of running it as root.

In short: sudo ss -tulpn | grep :PORT for a quick look, sudo lsof -i :PORT for readable detail, and kill by PID once you know what you are stopping.