How to determine which program is using a port in Linux

There are situations when you need to find out which program is using a specific server port. In this article, we will look at three popular utilities that will help you solve this problem quick and easy.

Using ss

ss (socket statistics) - a modern command line utility that provides information about network sockets and connections. It's included by default in most modern Linux distributions.

A simple command to display all listening ports:
ss -tulpn

• -t - output only TCP sockets
• -u - output only UDP sockets
• -l - output only listened sockets
• -p - display process (PID/name)
• -n - do not convert hosts and ports

We can see the IP and port being used in the Local Address:Port column, and the process name and PID in the Process column.

We can use the more complex syntax of the utility itself to display information about a specific port:
ss -tulpn '( sport = :21 )'

• sport - filter by source port
• 21 - port of interest

A more familiar and convenient option is to use the grep utility:
ss -tulpn | grep ':21'

• 21 - port of interest

Using the netstat utility

netstat (network statistics) - an old utility used to display network connections, routing tables, interface statistics, and much more. It has been replaced by the ss utility in some modern systems, so their parameters are very similar.
For example, let's use grep to find which program is listening on port 21 (FTP):
netstat -tulpn | grep ':21'

• -t - output only TCP sockets
• -u - output only UDP sockets
• -l - output only listened sockets
• -p - display process (PID/name)
• -n - do not convert hosts and ports
• 21 - port of interest

It was the ProFTP service (PID/program name in the last column):

Using the lsof utility

lsof (list open files) - a utility that shows which files and sockets are open by various processes.
Command:
lsof -Pn -i :21

• -P - disable port conversion to service names
• -n - disable conversion of IP addresses to domains
• -i - show network connections
• 21 - port of interest

The  program using the specified port is shown in the COMMAND and PID columns:


We have looked at three of the simplest ways to detect a program that is using the port we are interested in.
If you encounter any problems with this task on our VPS or dedicated servers, you can always contact our technical support team - we will be happy to help!