753

I am installing hadoop on my Ubuntu system. When I start it, it reports that port 9000 is busy.

I used:

netstat -nlp|grep 9000

to see if such a port exists and I got this:

   tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN

But how can I get the PID of the process which is holding it?

5

8 Answers 8

949

Your existing command doesn't work because Linux requires you to either be root or the owner of the process to get the information you desire.

On modern systems, ss is the appropriate tool to use to get this information:

$ sudo ss -lptn 'sport = :80'
State   Local Address:Port  Peer Address:Port              
LISTEN  127.0.0.1:80        *:*                users:(("nginx",pid=125004,fd=12))
LISTEN  ::1:80              :::*               users:(("nginx",pid=125004,fd=11))

You can also use the same invocation you're currently using, but you must first elevate with sudo:

$ sudo netstat -nlp | grep :80
tcp  0  0  0.0.0.0:80  0.0.0.0:*  LISTEN  125004/nginx

You can also use lsof:

$ sudo lsof -n -i :80 | grep LISTEN
nginx   125004 nginx    3u  IPv4   6645      0t0  TCP 0.0.0.0:80 (LISTEN)
17
  • 66
    Note: under OSX, the -p option is for protocol rather than process. See this question
    – Bryan P
    Apr 10, 2016 at 16:51
  • 4
    @BryanP the OP asked for Ubuntu so that's kinda irrelevant...
    – Adam B
    Sep 21, 2016 at 14:26
  • 88
    @AdamB Unless a Mac user arrived here searching for Finding the PID of the process using a specific port Oct 10, 2016 at 11:05
  • 3
    This answer would probably be improved by putting the need to sudo at the top.
    – Nacht
    Jan 6, 2017 at 1:10
  • 8
    @MrOnyancha Use the terse (-t) options - lsof -ti tcp:80
    – Mohnish
    Jul 19, 2017 at 13:58
250

Also you can use lsof utility. Need to be root.

# lsof -i :25
COMMAND  PID        USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
exim4   2799 Debian-exim    3u  IPv4   6645      0t0  TCP localhost:smtp (LISTEN)
exim4   2799 Debian-exim    4u  IPv6   6646      0t0  TCP localhost:smtp (LISTEN)
4
  • 12
    This command will also give you processes with established connections, not just processes that are listening.
    – firelynx
    Aug 18, 2015 at 10:10
  • 4
    Not necessarily to be root. And, for those who want to get PID only, you can lsof -i :25 -Fp, which produces output like p1234.
    – Robert
    Mar 9, 2017 at 10:27
  • Important to note that you may need to run as sudo as some processes may be inaccessible to the user. Mar 25, 2021 at 1:18
  • For more information on lsof: tecmint.com/10-lsof-command-examples-in-linux Apr 26, 2021 at 12:43
28

I am using "CentOS 7 minimal" which has nor netstat neither lsof. But a lot of linux distributions have the socket statistics command (i.e. ss).

Here is an example of execution:

# ss -tanp | grep 6379
LISTEN   0    128  127.0.0.1:6379   *:*   users:(("redis-server",pid=2531,fd=4))
1
22

Also you can use fuser:

fuser -v -n tcp 22

The output :

                     USER        PID ACCESS COMMAND
22/tcp:              root        598 F.... sshd
3
  • 1
    It doesn't working fuser -v -n tcp 80, even I try with sudo
    – SuperKrish
    Dec 2, 2016 at 5:42
  • 1
    Note: This requires sudo if the offending process was also started with sudo Jan 21, 2017 at 8:14
  • 1
    This is a good thing to remember generally. Commands in Linux generally won't give information on processes started by root/sudo unless the command is run with Sudo. This is true even when the command does not normally need sudo to run correctly.
    – njfife
    Jul 6, 2017 at 21:15
17

Running the command with sudo would give you the PID. On my development machine I get:

$ netstat -nlp | grep 8080
tcp6       0      0 :::8080      :::*       LISTEN      -

$ sudo netstat -nlp | grep 8080
tcp6       0      0 :::8080      :::*       LISTEN      16449/java

And as mentioned in other answers you can also use the ss or the lsof commands.

2
  • running command as sudo display process ID May 10, 2018 at 8:10
  • 1
    But what if sudo netstat -nlp | grep 34157 still display - instead of PID? May 10, 2018 at 8:16
5

I'm working on a Yocto Linux system that has a limited set of available Linux tools. I managed to find the process of a running port using the following commands (where I find the process using port 1883):

root@root:~# netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 0.0.0.0:hostmon         0.0.0.0:*               LISTEN      
tcp        0      0 localhost.localdomain:domain 0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:9080            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:1883            0.0.0.0:*               LISTEN      
tcp        0      0 :::hostmon              :::*                    LISTEN      
tcp        0      0 localhost:domain        :::*                    LISTEN      
tcp        0      0 :::ssh                  :::*                    LISTEN      
tcp        0      0 :::1883                 :::*                    LISTEN      
root@root:~# fuser 1883/tcp
290 
root@root:~# ps | grep 290
  290 mosquitt 25508 S    /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
12141 root      8444 S    grep 290

As we can see above, it's the program /usr/sbin/mosquitto that's using port 1883.

1

Try netstat -tulpen PORT.

e.g. netstat -tulpen 35729

Proto Recv-Q Send-Q Local Address           Foreign Address         State       Benutzer   Inode      PID/Program name    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      0          55233      -                   
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      1000       3166326    364815/node         
tcp        0      0 127.0.0.1:33060         0.0.0.0:*               LISTEN      127        36032      -                   
tcp        0      0 127.0.0.1:587           0.0.0.0:*               LISTEN      0          55234      -                   
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      0          2927660    -                   
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      127        36034      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          30995      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      101        26903      -                   
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      132        32262      -                   
tcp6       0      0 127.0.0.1:9300          :::*                    LISTEN      129        40952      -                   
tcp6       0      0 :::35729                :::*                    LISTEN      1000       3088940    355480/grunt        
tcp6       0      0 ::1:9300                :::*                    LISTEN      129        40945      -                   
tcp6       0      0 ::1:9200                :::*                    LISTEN      129        41261      -                   
tcp6       0      0 ::1:631                 :::*                    LISTEN      0          2927659    -                   
tcp6       0      0 127.0.0.1:9200          :::*                    LISTEN      129        41262      -                   
tcp6       0      0 :::9003                 :::*                    LISTEN      1000       3234646    373445/code         
tcp6       0      0 :::22                   :::*                    LISTEN      0          31006      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      0          940224     -                   
tcp6       0      0 ::1:6379                :::*                    LISTEN      132        32263      -                   
udp        0      0 127.0.0.53:53           0.0.0.0:*                           101        26902      -                   
udp        0      0 0.0.0.0:631             0.0.0.0:*                           0          2927684    -                   
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           115        29345      -                   
udp        0      0 0.0.0.0:42443           0.0.0.0:*                           115        29347      -                   
udp6       0      0 :::5353                 :::*                                115        29346      -                   
udp6       0      0 :::34477                :::*                                115        29348      -  
0

Get PID by itself into a shell variable

A bit of awk action to help when scripting:

port=9050
pid="$(sudo netstat -nlp | awk '$4~":'"$port"'"{ gsub(/\/.*/,"",$7); print $7 }')"

Now pid contains just he numerical PID, e.g. 7094.

Tested on Ubuntu 23.04.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .