How to Find Which Process Is Using a Port in Linux (ss, lsof, fuser)

Applies to: ss, lsof and fuser on Ubuntu 24.04, Debian 13, AlmaLinux and Rocky Linux 9

“Address already in use” means another program already listens on the port your service wants. These commands show which program it is. We tested them on Ubuntu 24.04.

ss (installed everywhere)

sudo ss -ltnp                       # all listening TCP ports with the program
sudo ss -lunp                       # UDP ports
sudo ss -ltnp 'sport = :80'         # just port 80

The last column shows the program and its process ID, for example users:(("sshd",pid=8168,fd=3)). Without sudo you see the ports but not other users’ programs.

lsof

sudo lsof -i :80 -sTCP:LISTEN
sudo lsof -i -P -n | grep LISTEN

Install it with sudo apt install lsof or sudo dnf install lsof if it is missing.

fuser

sudo fuser 80/tcp                   # prints the process ID(s)
sudo fuser -k 80/tcp                # stop them (careful)

Then what?

• Find what the process is: ps -fp 1234 or systemctl status 1234.
• If it is a service that shouldn’t be there (for example Apache and Nginx both wanting port 80), stop and disable it: sudo systemctl disable --now apache2.
• Or move your service to another port.

Port open but not reachable from outside?

• 127.0.0.1:3000 in the Local Address column means the program listens only on the server itself; 0.0.0.0 or * means all addresses.
• Check the firewall: sudo ufw status or sudo firewall-cmd --list-all.
• Test from another computer: nc -zv SERVER-IP 3000.

Port numbers reference: HTTPS, SSL and email ports. Processes in general: list running processes.