TL;DR
Three steps: ss -tlnp to list listeners, lsof -i :PORT to find the owner, ps -p PID -o pid,cmd to confirm before kill.
List Listeners
| Action | Command |
|---|---|
| All TCP listeners with processes | ss -tlnp |
| Filter by port | ss -tlnp 'sport = :8080' |
| Legacy | netstat -tlnp |
| UDP | ss -ulnp |
Find Processes
| Action | Command | |
|---|---|---|
| Who owns the port | lsof -i :8080 | |
| Find by name | pgrep -f keyword | |
| Process details | ps -p PID -o pid,user,cmd | |
| Filter ps output | `ps aux | grep keyword` |
Handle Processes
| Action | Command |
|---|---|
| Graceful kill | kill PID |
| Force kill | kill -9 PID |
| Kill by name | pkill -f keyword |
Tips
- 127.0.0.1 = localhost only; 0.0.0.0 /
*= exposed. - Missing process names in
ssusually means missing privileges; use sudo. - Verify PID mapping before killing.
FAQ
How do I find which process is using port 8080?
Run ss -tlnp 'sport = :8080' (add sudo if the process name is missing), or use lsof -i :8080. On older systems, netstat -tlnp works the same way.
Why can't I see process names in ss output?
ss only shows process names when run as root. Use sudo ss -tlnp.
How do I kill the process holding a port?
Get the PID from lsof -i :PORT or ss -tlnp, confirm it with ps -p PID -o pid,cmd, then kill PID. Only use kill -9 after confirming it is safe.
How can I tell if a port is exposed to the internet?
Check the listen address: 127.0.0.1 means localhost only; 0.0.0.0 or * listens on all interfaces. Then verify from another machine with nc -vz SERVER_IP PORT.
What's the difference between netstat and ss?
ss is the modern replacement for netstat: faster and shows processes by default (as root). netstat comes from net-tools and is still common on older systems.
Sources
- Linux man pages (ss / lsof / ps / kill)