Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I am installing hadoop on my Ubuntu system. When I start it, it reports that port 9000 is busy.
I used:
netstat -nlp|grep 9000
to see if such a port exists and I got this:
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN
But how can I get the PID of the process which is holding it?
Your existing command doesn't work because Linux requires you to either be root or the owner of the process to get the information you desire.
On modern systems, ss is the appropriate tool to use to get this information:
$ sudo ss -lptn 'sport = :80'
State Local Address:Port Peer Address:Port
LISTEN 127.0.0.1:80 *:* users:(("nginx",pid=125004,fd=12))
LISTEN ::1:80 :::* users:(("nginx",pid=125004,fd=11))
You can also use the same invocation you're currently using, but you must first elevate with sudo:
$ sudo netstat -nlp | grep :80
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 125004/nginx
You can also use lsof:
$ sudo lsof -n -i :80 | grep LISTEN
nginx 125004 nginx 3u IPv4 6645 0t0 TCP 0.0.0.0:80 (LISTEN)
-p option is for protocol rather than process. See this question
Finding the PID of the process using a specific port
Oct 10, 2016 at 11:05
sudo at the top.
Also you can use lsof utility. Need to be root.
# lsof -i :25
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
exim4 2799 Debian-exim 3u IPv4 6645 0t0 TCP localhost:smtp (LISTEN)
exim4 2799 Debian-exim 4u IPv6 6646 0t0 TCP localhost:smtp (LISTEN)
established connections, not just processes that are listening.
lsof -i :25 -Fp, which produces output like p1234.
sudo as some processes may be inaccessible to the user.
Mar 25, 2021 at 1:18
lsof: tecmint.com/10-lsof-command-examples-in-linux
Apr 26, 2021 at 12:43
I am using "CentOS 7 minimal" which has nor netstat neither lsof. But a lot of linux distributions have the socket statistics command (i.e. ss).
Here is an example of execution:
# ss -tanp | grep 6379
LISTEN 0 128 127.0.0.1:6379 *:* users:(("redis-server",pid=2531,fd=4))
Also you can use fuser:
fuser -v -n tcp 22
The output :
USER PID ACCESS COMMAND
22/tcp: root 598 F.... sshd
sudo if the offending process was also started with sudo
Jan 21, 2017 at 8:14
Running the command with sudo would give you the PID. On my development machine I get:
$ netstat -nlp | grep 8080
tcp6 0 0 :::8080 :::* LISTEN -
$ sudo netstat -nlp | grep 8080
tcp6 0 0 :::8080 :::* LISTEN 16449/java
And as mentioned in other answers you can also use the ss or the lsof commands.
sudo netstat -nlp | grep 34157 still display - instead of PID?
May 10, 2018 at 8:16
I'm working on a Yocto Linux system that has a limited set of available Linux tools. I managed to find the process of a running port using the following commands (where I find the process using port 1883):
root@root:~# netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:hostmon 0.0.0.0:* LISTEN
tcp 0 0 localhost.localdomain:domain 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9080 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:1883 0.0.0.0:* LISTEN
tcp 0 0 :::hostmon :::* LISTEN
tcp 0 0 localhost:domain :::* LISTEN
tcp 0 0 :::ssh :::* LISTEN
tcp 0 0 :::1883 :::* LISTEN
root@root:~# fuser 1883/tcp
290
root@root:~# ps | grep 290
290 mosquitt 25508 S /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
12141 root 8444 S grep 290
As we can see above, it's the program /usr/sbin/mosquitto that's using port 1883.
Try netstat -tulpen PORT.
e.g. netstat -tulpen 35729
Proto Recv-Q Send-Q Local Address Foreign Address State Benutzer Inode PID/Program name
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 0 55233 -
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 1000 3166326 364815/node
tcp 0 0 127.0.0.1:33060 0.0.0.0:* LISTEN 127 36032 -
tcp 0 0 127.0.0.1:587 0.0.0.0:* LISTEN 0 55234 -
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 0 2927660 -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 127 36034 -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 30995 -
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 101 26903 -
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 132 32262 -
tcp6 0 0 127.0.0.1:9300 :::* LISTEN 129 40952 -
tcp6 0 0 :::35729 :::* LISTEN 1000 3088940 355480/grunt
tcp6 0 0 ::1:9300 :::* LISTEN 129 40945 -
tcp6 0 0 ::1:9200 :::* LISTEN 129 41261 -
tcp6 0 0 ::1:631 :::* LISTEN 0 2927659 -
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 129 41262 -
tcp6 0 0 :::9003 :::* LISTEN 1000 3234646 373445/code
tcp6 0 0 :::22 :::* LISTEN 0 31006 -
tcp6 0 0 :::80 :::* LISTEN 0 940224 -
tcp6 0 0 ::1:6379 :::* LISTEN 132 32263 -
udp 0 0 127.0.0.53:53 0.0.0.0:* 101 26902 -
udp 0 0 0.0.0.0:631 0.0.0.0:* 0 2927684 -
udp 0 0 0.0.0.0:5353 0.0.0.0:* 115 29345 -
udp 0 0 0.0.0.0:42443 0.0.0.0:* 115 29347 -
udp6 0 0 :::5353 :::* 115 29346 -
udp6 0 0 :::34477 :::* 115 29348 -
netstatcommand might work in many operations systems to allow you get that, you just have to find the arguments that will ensure it will show pids along each known opened port.sudo?