Check If a Port Is Being Used On Linux, Mac Or Windows

2020-07-18 13:50:05 | #sysadmin

Tested On

  • Linux Ubuntu 20.04
  • Windows 10
  • macOS Catalina

Problem: You need to identify which process or application is running on a specific port.

Solution: Learn about and use a variety of tools that identify which ports are being used.

The netstat Command (Linux and Older Versions of macOS)

To list listening ports and their corresponding applications, run netstat and pipe the result through grep with the following command:

netstat -tulpn | grep LISTEN
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 0.0.0.0:4579            0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 0.0.0.0:4582            0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 0.0.0.0:33351           0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 127.0.0.1:40137         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:57993           0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 127.0.0.1:39145         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:4586            0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 0.0.0.0:4587            0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 0.0.0.0:40011           0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 0.0.0.0:54219           0.0.0.0:*               LISTEN      18648/python3       
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:4593            0.0.0.0:*               LISTEN      18648/python3       
tcp6       0      0 ::1:631                 :::*                    LISTEN      -                   
tcp6       0      0 :::35483                :::*                    LISTEN      18966/java

As you've noticed, we passed some arguments to netstat. Here's a breakdown of each one. Note: Some arguments are not supported on all platforms. See Wikipedia for more information.

-t, --statistics         display only TCP connections
-u, --statistics         display only UDP connections
-l, --listening          display listening server sockets
-p, --programs           display PID/Program name for sockets
-n, --numeric            don't resolve names

To check for what's listening on a specific port, grep the output with the port number. Port 80 for example:

netstat -tulpn | grep 80
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
udp        0      0 0.0.0.0:38049           0.0.0.0:*                           -

The lsof Command (Linux and macOS El Capitan and Newer)

An alternative way to view listening ports and services is by running lsof.

sudo lsof -i -P -n
COMMAND      PID            USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME                                                                                             
systemd-r    836 systemd-resolve   12u  IPv4   23174      0t0  UDP 127.0.0.53:53                                                                                    
systemd-r    836 systemd-resolve   13u  IPv4   23175      0t0  TCP 127.0.0.53:53 (LISTEN)
avahi-dae    865           avahi   12u  IPv4   31177      0t0  UDP *:5353         
avahi-dae    865           avahi   13u  IPv6   31178      0t0  UDP *:5353                                                                                           
avahi-dae    865           avahi   14u  IPv4   31179      0t0  UDP *:36791        
avahi-dae    865           avahi   15u  IPv6   31180      0t0  UDP *:41501 
NetworkMa    870            root   26u  IPv4 2772546      0t0  UDP 192.168.1.5:68->192.168.1.1:67 

# Pipe through grep to list only LISTENING applications
sudo lsof -i -P -n | grep LISTEN
COMMAND      PID            USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
systemd-r    836 systemd-resolve   13u  IPv4   23175      0t0  TCP 127.0.0.53:53 (LISTEN)
container   1000            root    8u  IPv4   32951      0t0  TCP 127.0.0.1:39145 (LISTEN)
tor         1049      debian-tor    6u  IPv4   30084      0t0  TCP 127.0.0.1:9050 (LISTEN)
expressvp   2193            root    6u  IPv4   46310      0t0  TCP 127.0.0.1:2015 (LISTEN)
python3    16314             rob    3u  IPv4  311609      0t0  TCP *:5206 (LISTEN)                                                                                  
python3    16316             rob    3u  IPv4  311609      0t0  TCP *:5206 (LISTEN)
python3    16316             rob    4u  IPv4  311609      0t0  TCP *:5206 (LISTEN)                                                                                  
localstac  18648             rob    3u  IPv4  350232      0t0  TCP *:4566 (LISTEN)

To check for what's listening on a specific port, you can specify the port in the command. Port 3000 for example:

sudo lsof -i tcp:80
COMMAND   PID     USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
nginx   95440     root    8u  IPv4 2695842      0t0  TCP *:http (LISTEN)
nginx   95441 www-data    8u  IPv4 2695842      0t0  TCP *:http (LISTEN)
nginx   95448 www-data    8u  IPv4 2695842      0t0  TCP *:http (LISTEN)

The nmap command

An alternative way to view listening ports and services is by running nmap. You may need to install it first. To install nmap on Ubuntu, run sudo apt get nmap.

# List open TCP ports
sudo nmap -sT -O localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-18 14:29 +01
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000073s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
631/tcp  open  ipp
4567/tcp open  tram
9050/tcp open  tor-socks
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds

# List open UDP ports
sudo nmap -sU -O localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-18 14:30 +01
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000051s latency).
Not shown: 998 closed ports
PORT     STATE         SERVICE
631/udp  open|filtered ipp
5353/udp open|filtered zeroconf
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.91 seconds

The cmd Command (Windows)

C:\> netstat -a -b

PowerShell (Windows)

Substitute MyPortNumber with your port number.

Get-Process -Id (Get-NetTCPConnection -LocalPort MyPortNumber).OwningProcess

Want To See More Exercises?

View Exercises View Courses

Comments

You must log in to comment. Don't have an account? Sign up for free.

Subscribe to comments for this post

Want To Receive More Free Content?

Would you like to receive free resources, tailored to help you reach your IT goals? Get started now, by leaving your email address below. We promise not to spam. You can also sign up for a free account and follow us on and engage with the community. You may opt out at any time.



Tell Us About Your Project









Contact Us

Do you have a specific IT problem that needs solving or just have a general IT question? Use the contact form to get in touch with us and an IT professional will be with you, momentarily.

Hire Us

We offer web development, enterprise software development, QA & testing, google analytics, domains and hosting, databases, security, IT consulting, and other IT-related services.

Free IT Tutorials

Head over to our tutorials section to learn all about working with various IT solutions.

Contact