Check If a Port Is Being Used On Linux, Mac Or Windows
2020-07-18 13:50:05 |
Tested On
- Linux Ubuntu 20.04
Problem: You need to identify which process or application is running on a specific port.
Solution: Learn about and use a variety of tools that identify which ports are being used.
The netstat Command (Linux and Older Versions of macOS)
To list listening ports and their corresponding applications, run netstat and pipe the result through grep with the following command:
netstat -tulpn | grep LISTEN
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 0 0 0.0.0.0:4579 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 0.0.0.0:4582 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 0.0.0.0:33351 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 127.0.0.1:40137 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:57993 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 127.0.0.1:39145 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:4586 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 0.0.0.0:4587 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 0.0.0.0:40011 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 0.0.0.0:54219 0.0.0.0:* LISTEN 18648/python3
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:4593 0.0.0.0:* LISTEN 18648/python3
tcp6 0 0 ::1:631 :::* LISTEN -
tcp6 0 0 :::35483 :::* LISTEN 18966/javaAs you've noticed, we passed some arguments to netstat. Here's a breakdown of each one. Note: Some arguments are not supported on all platforms. See Wikipedia for more information.
-t, --statistics display only TCP connections
-u, --statistics display only UDP connections
-l, --listening display listening server sockets
-p, --programs display PID/Program name for sockets
-n, --numeric don't resolve names
To check for what's listening on a specific port, grep the output with the port number. Port 80 for example:
netstat -tulpn | grep 80
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
udp 0 0 0.0.0.0:38049 0.0.0.0:* -The lsof Command (Linux and macOS El Capitan and Newer)
An alternative way to view listening ports and services is by running lsof.
sudo lsof -i -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd-r 836 systemd-resolve 12u IPv4 23174 0t0 UDP 127.0.0.53:53
systemd-r 836 systemd-resolve 13u IPv4 23175 0t0 TCP 127.0.0.53:53 (LISTEN)
avahi-dae 865 avahi 12u IPv4 31177 0t0 UDP *:5353
avahi-dae 865 avahi 13u IPv6 31178 0t0 UDP *:5353
avahi-dae 865 avahi 14u IPv4 31179 0t0 UDP *:36791
avahi-dae 865 avahi 15u IPv6 31180 0t0 UDP *:41501
NetworkMa 870 root 26u IPv4 2772546 0t0 UDP 192.168.1.5:68->192.168.1.1:67
# Pipe through grep to list only LISTENING applications
sudo lsof -i -P -n | grep LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd-r 836 systemd-resolve 13u IPv4 23175 0t0 TCP 127.0.0.53:53 (LISTEN)
container 1000 root 8u IPv4 32951 0t0 TCP 127.0.0.1:39145 (LISTEN)
tor 1049 debian-tor 6u IPv4 30084 0t0 TCP 127.0.0.1:9050 (LISTEN)
expressvp 2193 root 6u IPv4 46310 0t0 TCP 127.0.0.1:2015 (LISTEN)
python3 16314 rob 3u IPv4 311609 0t0 TCP *:5206 (LISTEN)
python3 16316 rob 3u IPv4 311609 0t0 TCP *:5206 (LISTEN)
python3 16316 rob 4u IPv4 311609 0t0 TCP *:5206 (LISTEN)
localstac 18648 rob 3u IPv4 350232 0t0 TCP *:4566 (LISTEN)To check for what's listening on a specific port, you can specify the port in the command. Port 3000 for example:
sudo lsof -i tcp:80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 95440 root 8u IPv4 2695842 0t0 TCP *:http (LISTEN)
nginx 95441 www-data 8u IPv4 2695842 0t0 TCP *:http (LISTEN)
nginx 95448 www-data 8u IPv4 2695842 0t0 TCP *:http (LISTEN)The nmap command
An alternative way to view listening ports and services is by running nmap. You may need to install it first. To install nmap on Ubuntu, run sudo apt get nmap.
# List open TCP ports
sudo nmap -sT -O localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-18 14:29 +01
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000073s latency).
Not shown: 995 closed ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
631/tcp open ipp
4567/tcp open tram
9050/tcp open tor-socks
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
# List open UDP ports
sudo nmap -sU -O localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-18 14:30 +01
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000051s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
631/udp open|filtered ipp
5353/udp open|filtered zeroconf
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.91 secondsThe cmd Command (Windows)
C:\> netstat -a -bPowerShell (Windows)
Substitute MyPortNumber with your port number.
Get-Process -Id (Get-NetTCPConnection -LocalPort MyPortNumber).OwningProcess
Comments
You must log in to comment. Don't have an account? Sign up for free.