What Is Using a Port on Linux? Find and Kill the Process

What is using a port on Linux?

You start a dev server and get address already in use. Something else has already bound the port, and you need to know what. Working out what is using a port on Linux takes one command, and Linux gives you three good ways to do it.

Option 1: ss, the modern default

ss replaced netstat on most distributions and is installed almost everywhere.

sudo ss -tulpn | grep :8080

The flags: -t TCP, -u UDP, -l listening sockets only, -p show the process, -n numbers instead of names. The output ends with something like users:(("node",pid=4821,fd=19)), which gives you the program name and PID.

Without sudo you only see your own processes, so run it with sudo to see everything.

Option 2: lsof

sudo lsof -i :8080

lsof lists open files, and on Linux a network socket counts as a file. Its output has a readable table with the command, PID and user. Add -sTCP:LISTEN to ignore clients that are merely connected to the port.

sudo lsof -iTCP:8080 -sTCP:LISTEN

Option 3: fuser

sudo fuser 8080/tcp

fuser prints just the PID, which is handy in scripts. Its party trick is that it can also kill whatever it finds:

sudo fuser -k 8080/tcp

Stop the process

Once you have the PID, ask it to exit politely first:

kill 4821

That sends SIGTERM, which lets the program close files and clean up. Wait a moment and check the port again. Only if the process ignores it should you use the forceful version:

kill -9 4821

kill -9 cannot be caught, so the program gets no chance to clean up. Treat it as the last resort.

When the answer is not a normal process

• Docker: a container publishing the port shows up as docker-proxy. Run docker ps to see which container maps the port, then stop that container instead of killing the proxy.
• systemd socket activation: a .socket unit can hold the port even when the service looks stopped. Check with systemctl list-sockets and stop the socket unit.
• A service that restarts itself: if you kill a process and it comes straight back, it is managed by systemd or a supervisor. Stop it with sudo systemctl stop service-name rather than killing it.
• Ports below 1024 need root to bind, so a permission error is a different problem from an address-in-use error.

Quick reference

Make sure it is reachable

Finding the process is half the story. The listening address matters as much as the port. In the ss output, 127.0.0.1:8080 means only local programs can connect, while 0.0.0.0:8080 or [::]:8080 means the port is open on every interface. If a service is not reachable from another machine, that is usually the reason, along with a firewall rule.

To test a port from another machine, use nc -zv server-ip 8080. A succeeded message means the port is open end to end. If you only need your app to start, the quickest alternative is simply to run it on a different port.

• Find: sudo ss -tulpn | grep :PORT
• Find with a readable table: sudo lsof -i :PORT
• PID only: sudo fuser PORT/tcp
• Stop politely: kill PID
• Stop forcefully: kill -9 PID