We have sh scripts using 'netstat' in our production code. We use command 'netstat -lntup' to retrieve all the pids which are listening to some port. I replaced the command with 'ss -lntup. Now, for most cases outputs for the two commands are the same, but there are cases when 'ss' returns multiple pids for the same port, e.g.

# ss -lntup | grep http

tcp  LISTEN 0  128  *:80  *:*  users:(("httpd",pid=2355,fd=4),("httpd",pid=1962,fd=4),("httpd",pid=1961,fd=4),("httpd",pid=1960,fd=4),("httpd",pid=1955,fd=4))

tcp  LISTEN 0  128  *:443  *:*  users:(("httpd",pid=2355,fd=6),("httpd",pid=1962,fd=6),("httpd",pid=1961,fd=6),("httpd",pid=1960,fd=6),("httpd",pid=1955,fd=6))

How should I interpret the list? Are the pids related in some way? Can multiple processes listen same pid at the same time?


  • You can run ps -auxf to get a tree representation of your processes, I'm pretty sure these processes are all httpd processes. Jun 15 '20 at 16:03

Are the pids related in some way?

In this case obviously yes. Either they have a common parent process or one of the processes is the parent process of the other ones.

The common file handle (4 for port 80 and 6 for port 443) is an indication that the parent process created a "socket" before starting the child processes.

Can multiple processes listen same port at the same time?

Not processes (pids) are listening on a port but "sockets" listen on a port.

Sockets are certain network-related objects in the memory of the computer.

As Eduardo Trápani already wrote, multiple sockets can listen on a port if SO_REUSEPORT is used. However, this is (probably) not the case here. I assume that only two sockets (one on port 80 and one on port 443) are involved:

If a process (pid) creates a socket and then it creates child processes, the process and its children normally share the socket after the child processes have been created.

The OS knows which socket is listening on which port, but because the socket is (at least officially) shared between multiple pids, it cannot find out which pid is actually listening.

I assume that only the parent process is really using the socket; but the OS cannot know this.

  • This is almost certainly Apache with multiple workers.
    – JdeBP
    Jun 16 '20 at 8:59

Are the pids related in some way?

Not necessarily. They have to belong to the same effective user ID though, to prevent port hijacking.

Can multiple processes listen same pid/port at the same time?

Yes, with the socket option SO_REUSEPORT. This page (python example included) explains how it works and how it is related to SO_REUSEADDR (also used in servers).

This is an excerpt from the page:


The behaviour of this option is similar concept to SO_REUSEADDR, but this option allow us to bind multiple TCP/UDP server sockets onto exact same IP and same port.

But there is 1 limitation on socket to share exact same IP and same port which is not in SO_REUSEADDR. All sockets to share the IP/port should be spawned by the process having same effective user. This can be applied for both protocol UDP/TCP, notice that binding multiple UDP server socket was possible with just SO_REUSEADDR without taking care effective user (processA executed by root open *:80 and processB executed by userA can open *:80 with SO_REUSEADDR). But SO_REUSEPORT doesn’t allow it. As for looking at just this point, we can think SO_REUSEPORT as more restricted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.