Identifying Which Process Listens on a Port in Linux

When your application fails to bind to a port, you need to identify what’s already using it. This is one of the most common debugging tasks in Linux system administration.

Using ss (Modern Approach)

The ss command has largely replaced netstat in modern Linux distributions. It’s faster, more efficient, and provides clearer output:

ss -ltnp | grep :9999

Breaking down the flags:

l — show listening sockets only
t — TCP sockets
n — numeric addresses (no DNS lookups)
p — include process name and PID

If you need to check UDP ports as well:

ss -ltnup | grep :9999

For a specific port without grep:

ss -ltnp sport = :9999

You’ll typically need sudo to see process names and PIDs for sockets owned by other users:

sudo ss -ltnp | grep :9999

Using netstat (Legacy Alternative)

If your system still uses netstat, the syntax is similar:

sudo netstat -pln | grep 9999

The flags mean:

p — show process information
l — listening sockets
n — numeric format

Add t for TCP-only or u for UDP-only filtering:

sudo netstat -ptln | grep 9999
sudo netstat -puln | grep 9999

Using lsof

Another useful tool is lsof, which shows open files and network connections:

sudo lsof -i :9999

This gives you the process name, PID, user, and connection status in an easy-to-read format.

Practical Examples

Check what’s listening on port 80:

sudo ss -ltnp | grep :80

Example output:

LISTEN    0      511                0.0.0.0:80              0.0.0.0:*    users:(("nginx",pid=1234,fd=6))

Find all processes listening on any port:

sudo ss -ltnp

Check if a specific service (like PostgreSQL on port 5432) is running:

sudo ss -ltnp | grep :5432

Verify both TCP and UDP listeners on port 53 (DNS):

sudo ss -ltnup | grep :53

Permission Notes

If you run these commands without sudo, you’ll only see processes owned by your current user. System services and processes owned by other users will show as (-) in the output. Always use sudo for complete visibility when troubleshooting port conflicts.

Why ss Over netstat

The netstat command is deprecated in many distributions. ss is part of the iproute2 package and provides superior performance, especially on systems with many connections. If you’re writing scripts or automation for modern systems, prefer ss.