I'm looking to list all ports a PID is currently listening on.

How would you recommend I get this kind of data about a process?

  • Weird enough ss has no filtering on PID except for netlink sockets.
    – poige
    Oct 25, 2018 at 4:38

7 Answers 7


You can use ss from the iproute2 package (which is similar to netstat):

ss -l -p -n | grep "pid=1234,"

or (for older iproute2 version):

ss -l -p -n | grep ",1234,"

Replace 1234 with the PID of the program.

  • 3
    There is also -u or -t for udb or tcp only. :+1: And these can all be stacked like so: ss -tlnp, And to eliminate fill width output, which I find annoying you can pipe though cat or less or w/e: ss -tlnp | cat Oct 6, 2015 at 17:53
  • 1
    I've gotten into the habit ss -nlp | cat, that's roughly, show me listening processes (-l), their port numbers (-n), and their process info (-p), and don't try to fit the output to my shell | cat (or less or whatever). Only took me two years to get used to that :D Jul 9, 2016 at 21:48
  • Didn't work for me (on Debian 9). There you need to grep for ",pid=1234,"
    – ofrommel
    Nov 9, 2018 at 10:44
  • @ofrommel thanks for the hint - I adapted the answer.
    – jofel
    Nov 27, 2018 at 11:40
  • 4
    Also, this does only work with root permissions :)
    – ofrommel
    Nov 30, 2018 at 17:28

I am not aware of a way using iproute2 tools. But as a workaround, you could try this one out.

lsof -Pan -p PID -i

should give you the information you are looking for.


lsof -Pan -p 27808 -i
httpd   27808 apache    5u  IPv6 112811294      0t0  TCP *:80 (LISTEN)
httpd   27808 apache    7u  IPv6 112811298      0t0  TCP *:8443 (LISTEN)
httpd   27808 apache    9u  IPv6 112811303      0t0  TCP *:443 (LISTEN)

I got this command from here but not sure of the exact link since I have all of them noted down in the notebook. But you could check out from there as well.


You can use netstat for this to figure out pid of each listen process.

netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

-a, --all Show both listening and non-listening (for TCP this means established connections) sockets. With the --interfaces option, show interfaces that are not marked

--numeric , -n Show numerical addresses instead of trying to determine symbolic host, port or user names.

-p, --program Show the PID and name of the program to which each socket belongs.

Here is an example:

# netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0       *                   LISTEN      1507/rpcbind
tcp        0      0     *                   LISTEN      1651/rpc.statd
tcp        0      0      *                   LISTEN      1680/ypbind
tcp        0      0        *                   LISTEN      1975/sshd
tcp        0      0     *                   LISTEN      1763/cupsd
tcp        0      0      *                   LISTEN      2081/master
tcp        0      0   *                   LISTEN      2119/mongod
tcp        0     48           ESTABLISHED 25473/sshd
tcp        0      0           ESTABLISHED 24699/sshd
tcp        0      0 :::111                      :::*                        LISTEN      1507/rpcbind
tcp        0      0 :::9200                     :::*                        LISTEN      1994/java
tcp        0      0 :::9300                     :::*                        LISTEN      1994/java
tcp        0      0 :::22                       :::*                        LISTEN      1975/sshd
tcp        0      0 ::1:631                     :::*                        LISTEN      1763/cupsd
tcp        0      0 ::1:25                      :::*                        LISTEN      2081/master
tcp        0      0 :::59162                    :::*                        LISTEN      1651/rpc.statd
  • 2
    Thank you though I've been informed that netstat has been deprecated by iproute2 tools and I'm looking to avoid it. Sep 27, 2014 at 6:45

@jofel's answer shows you the appropriate tool to use, ss, here's the replacements for the other networking tools in iproute2.

The deprecated commands and their iproute2 equivalents are as follows:

deprecated      replacement(s)
==========      ==============
- arp           ip n (ip neighbor)
- ifconfig      ip a (ip addr), ip link, ip -s (ip -stats)
- iptunnel      ip tunnel
- iwconfig      iw
- nameif        ip link, ifrename
- netstat       ss, ip route (for netstat-r), ip -s link (for netstat -i), 
                ip maddr (for netstat-g)

- route         ip r (ip route)

The basic list is also here on Wikipedia: http://en.wikipedia.org/wiki/Iproute2.



Another method for lsof if you don't know the PID, but just the name of the Program:

lsof -Pa -p $(pgrep [programName]) -i
  • doesn't work with lsof 4.89 on ubuntu 16.04
    – palik
    Dec 12, 2018 at 11:12
  • 1
    That will be the case if the program has spawned multiple processes.which in that case you will need to specify the specific PID when running the lsof command I gave. pgrep <program name> then choose the PID you need for the above command. replacing $(pgrep [programName]) with the PID#
    – Demon
    Dec 12, 2018 at 15:21
  • 2
    lsof -Pan -c programName -i
    – htaccess
    Nov 9, 2020 at 1:27

Have you tried, this also does same

netstat -plnt | grep 27071



If 1072 is the process id, then you can run:

  1. sudo netstat -nlp | grep -w "1072"

    $ sudo netstat -nlp | grep -w "1072"
    Proto Recv-Q Send-Q Local Address   Foreign Address    State      
    tcp        0      0*       LISTEN      1072/your_process_name  
    udp        0      0*                   1072/your_process_name


  2. sudo ss -lnp | grep -w "pid=1072"

    $ sudo ss -lnp | grep -w "pid=1072"
    udp    UNCONN     0      0         *:5060   *:*   users:(("your_process_name",pid=1072,fd=40))
    tcp    LISTEN     0      1023      *:5060   *:*   users:(("your_process_name",pid=1072,fd=44))

Process name: your_process_name
Process ID: 1072
Port number: 5060

Note (docker or kubernetes):

If you running the above command inside a docker/kubernetes container, then the process id and the process name may not be shown in the output of ss or netstat command due to insufficient privileges. You can use SYS_PTRACE linux capability inside your Docker container as mentioned here or in your Kubernetes spec file as mentioned here.

However, you should NOT use SYS_PTRACE in production, since SYS_PTRACE can be abused to gain root access via privilege escalation as mentioned here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .