Get Process Name from Port Number in Linux

To find the process name using a port number in Linux, use lsof -i :PORT or fuser PORT/tcp; the first shows the process name and PID, the second just the PID (which you can pair with ps). This guide explains the main commands, how to read their output, and what to do when you lack permissions or the tools aren’t installed.

Why You Need This

Every network connection on a Linux system is tied to a process. When a port is occupied—say, you try to start a web server and get Address already in use—you need to identify which program is holding it. The same need arises when auditing security, debugging a misconfigured service, or cleaning up orphaned processes. Linux provides several built-in utilities to map ports to processes, each with different strengths.

The Core Commands

Three commands are the workhorses for this task. All are usually pre-installed, though lsof may require installation on minimal systems.

• lsof -i :8080 — Lists the PID and process name for anything using TCP or UDP port 8080.
• fuser 8080/tcp — Prints the PID(s) using TCP port 8080. Add -v for a verbose table that includes the process name.
• ss -ltnp 'sport = :8080' — Shows listening TCP sockets with the process name (requires root to see the name).

For example, to see what’s on port 8080:

$ lsof -i :8080
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
java    12345   bob   3u   IPv4 123456      0t0  TCP *:8080 (LISTEN)

The COMMAND column is the process name, and PID is the process ID. If you only need the PID, fuser is faster and more script-friendly:

$ fuser 8080/tcp
8080/tcp:  12345

How the Tools Work

These commands read kernel data structures that track network sockets. lsof (list open files) treats sockets as files and scans /proc/net/tcp and /proc/net/udp to match port numbers to inode numbers, then cross-references those inodes with the file descriptors of running processes. ss (socket statistics) uses netlink sockets to query the kernel directly, which is faster and more modern than the older netstat. fuser uses similar /proc inspection but is designed for quick PID lookup and can also kill processes if you pass -k (use with caution).

All three rely on the /proc filesystem, which is a virtual view of running processes. If a process is in a different network namespace (e.g., inside a container), you may need to run the command inside that namespace or use nsenter to see it.

Choosing the Right Command

Your choice depends on what you need and what’s installed:

• Quick name + PID: lsof -i :port is the most readable and widely used.
• Scripting (PID only): fuser port/tcp is concise and easy to parse.
• No extra install: ss is part of iproute2, which is almost always present on modern distros. netstat (from net-tools) is older but still common; use netstat -ltnp | grep :port.
• All connections, not just listening: lsof -i :port shows both listening and established connections. ss -tunap | grep :port gives similar coverage.

If you want to see the full command line (including arguments), combine the PID with ps:

ps -p 12345 -o pid,comm,args

Common Problems and Fixes

You’ll often hit one of these issues:

• Permission denied: Without root, ss and lsof may show the port but hide the process name (you’ll see - or the PID only). Use sudo to see the full info.
• Command not found: On minimal installs, lsof may be missing. Install it with your package manager (e.g., sudo apt install lsof on Debian/Ubuntu, sudo yum install lsof on RHEL/CentOS). fuser is in psmisc; ss is in iproute2.
• Port is UDP: Specify the protocol: lsof -i udp:53 or fuser 53/udp.
• IPv6 vs IPv4: Some tools show only one family. Use lsof -i :port (covers both) or ss -ltnp (shows both by default).
• Port in use by kernel: Some ports are reserved or used by kernel threads (e.g., NFS). The process name may appear as kernel or not show a PID.

Compare: lsof vs fuser vs ss

Here’s a quick comparison to help you pick:

• lsof: Rich output, shows user, FD, and connection state. Best for human inspection. Slightly heavier overhead.
• fuser: Minimal, fast, designed for scripts. Can kill processes directly with -k. No connection state info.
• ss: Modern, fast, shows socket details (send/receive queues, state). Requires root for process names. Also lists UNIX sockets and more.

All three are safe to run; none modify the system unless you explicitly use fuser -k or kill.

Safety and Permissions

Running these commands as a normal user is safe and read-only. However, to see process names for sockets owned by other users, you need root privileges. Always use sudo rather than logging in as root for daily tasks. If you find a suspicious process, do not kill it without verifying what it is—use ps -p PID -o args to see the full command line. Killing system processes can crash services or the entire machine.

Frequently Asked Questions

What if the port is not listening but a connection is active?

Use lsof -i :port without the -l flag; it shows both listening and established connections. ss -tunap | grep :port also works. The process name will appear for established connections as well.

Why does ss show a dash for the process name without sudo?

Because the kernel only exposes process ownership of sockets to privileged users. Running sudo ss -ltnp will reveal the process name. This is a security feature.

Can I get the process name from a port number in a Docker container?

Yes, but you need to run the command inside the container: docker exec <container> lsof -i :port. The container has its own network namespace, so the host’s tools won’t see the container’s processes.

What does fuser -k do?

It kills the process using the port. For example, fuser -k 8080/tcp sends SIGKILL to the process. Use with extreme caution—you could terminate an important service. Always check the PID first.

Is there a way to watch a port continuously?

You can use watch -n 1 'lsof -i :8080' to refresh every second. For a more detailed live view, ss -tunap with watch works too.

Related

• How to Enable Chromecast on Google Chrome
• Fix Wi-Fi No Valid IP Configuration in Windows 11
• Install curl & OpenSSL on Android: Full Guide