Find the Process Using a Port in Linux and Stop It (lsof, ss)

Updated: 12 October 2026 · Applies to: Ubuntu 26.04 (tested: iproute2 6.19, lsof 4.99.4, psmisc 23.7, net-tools 2.10), AlmaLinux 10.2 (lsof 4.98, psmisc 23.6), Debian 13 and Rocky Linux; Windows Server according to Microsoft

To find which process is using a port in Linux, run sudo ss -ltnp 'sport = :80' (replace 80 with your port). The users:(("nginx",pid=3373,fd=5)) part names the program and its process ID (PID). sudo lsof -nP -iTCP:80 -sTCP:LISTEN and sudo fuser -v 80/tcp give the same answer. Run them as root or with sudo: as a normal user they show the port but not the process.

1. ss (installed on every current distribution)

1. Show the process listening on TCP port 80:

   $ sudo ss -ltnp 'sport = :80'
   State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
   LISTEN 0      511        127.0.0.1:80        0.0.0.0:*    users:(("nginx",pid=3373,fd=5))

2. For a UDP port, use -lunp. UDP sockets show the state UNCONN instead of LISTEN:

   $ sudo ss -lunp 'sport = :5353'
   State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
   UNCONN 0      0          127.0.0.1:5353      0.0.0.0:*    users:(("python3",pid=3558,fd=3))

3. To list every listening port with its program, run sudo ss -ltunp. To check two ports at once: sudo ss -ltunp '( sport = :80 or sport = :443 )'.

The letters mean: l listening sockets, t TCP, u UDP, n numbers instead of names, p show the process. (Lab output from our Ubuntu 26.04 test container.)

2. lsof

$ sudo lsof -nP -iTCP:80 -sTCP:LISTEN
COMMAND  PID USER FD   TYPE  DEVICE SIZE/OFF NODE NAME
nginx   3373 root 5u  IPv4 8759742      0t0  TCP 127.0.0.1:80 (LISTEN)

• sudo lsof -i :80 is shorter, but it also lists open connections to and from that port, and without -nP it shows host and service names (myhost:http) instead of the address and port number.
• sudo lsof -t -i :80 prints only the PID (3373), which is handy in scripts.

sudo: lsof: command not found

lsof is not always installed. Install it:

sudo apt install lsof     # Ubuntu, Debian
sudo dnf install lsof     # AlmaLinux, Rocky Linux, RHEL, Fedora

The message depends on your sudo. Ubuntu 26.04 (sudo-rs) prints sudo: 'lsof': command not found; classic sudo (tested 1.9.17p2, the version AlmaLinux 10 ships) prints sudo: lsof: command not found. Without sudo, Ubuntu may suggest the package: Command 'lsof' not found, but can be installed with: sudo apt install lsof. If you cannot install anything, use ss, which is part of the base system.

3. fuser

$ sudo fuser -v 80/tcp
                     USER        PID ACCESS COMMAND
80/tcp:              root       3373 F.... nginx

fuser comes from the psmisc package (apt install psmisc or dnf install psmisc). Use 53/udp for UDP ports.

4. netstat (older systems)

$ sudo netstat -tulpn | grep ':80 '
tcp        0      0 127.0.0.1:80            0.0.0.0:*               LISTEN      3373/nginx: master

netstat is in the net-tools package, which current distributions no longer install by default; see netstat: command not found.

Why no process is shown

As a normal user, the commands cannot see processes owned by other users. In our test, ss showed the port with an empty Process column, lsof and fuser printed nothing (exit code 1), and netstat printed (No info could be read for "-p": geteuid()=1001 but you should be root.) with a - in place of the program. Run them with sudo.

From the PID to the service, and freeing the port

1. See the full command and the systemd unit it belongs to:

   $ ps -o pid,user,unit,cmd -p 3373
       PID USER     UNIT                            CMD
      3373 root     nginx.service                   nginx: master process /usr/sbin/nginx -g daemon on; master_process on;

   systemctl status 3373 also works: its first line names the unit, here nginx.service.
2. Stop it properly: sudo systemctl stop nginx, and sudo systemctl disable nginx if it should not start at boot. Killing the process instead may leave a service that systemd starts again.
3. If it is not a service, end the process: sudo kill 3373, or sudo fuser -k 80/tcp to end everything on that port (fuser sends SIGKILL, so the program gets no chance to clean up).

A typical case: nginx would not start because another program already held port 80. journalctl -u nginx showed nginx: [emerg] bind() to 127.0.0.1:80 failed (98: Address already in use), and ss -ltnp 'sport = :80' named a python3 process. After fuser -k 80/tcp, nginx started normally. Python reports the same problem as OSError: [Errno 98] Address already in use.

Windows: find the process using a port

According to Microsoft's documentation, in Command Prompt -o adds the PID to netstat's output and tasklist turns it into a program name:

netstat -ano | findstr :80
tasklist /fi "PID eq 1234"

In PowerShell:

Get-NetTCPConnection -LocalPort 80 -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
Get-Process -Id 1234

netstat -anob shows the program name directly, but Microsoft notes that -b fails without sufficient permissions, so run it in an administrator window.

Common problems

• Nothing listed, but the port is still busy: check both TCP and UDP (ss -ltunp), and IPv6 addresses such as [::]:80.
• The port is listening but unreachable from outside: a program bound to 127.0.0.1 (as in the examples above) accepts only local connections. Check the Local Address column, then your firewall; test from outside with nc.
• You want a list of all open ports, not one: see how to check open ports in Linux. To close one, see how to block a port.
• You want every option of ss, lsof and fuser, including UDP ports and filters: see how to find which process is using a port in Linux (ss, lsof, fuser).

Official documentation: ss manual page, netstat (Microsoft).