When I want to see the process ID for an application I do ps -aux | grep <application>. For example, when I do ps -aux | grep ssh I see the process ID for SSH.

But when I do ps -aux | grep tcp it outputs nothing, even though I am actively using internet.

How can I see process ID for TCP?

  • If you mean "Transmission Control Protocol TCP/IP", that is just part of a set of rules for how applications must communicate over the internet -- a Standard. See en.wikipedia.org/wiki/Internet_protocol_suite. Each process which talks via the internet uses one (or more) of the protocols. There will be many such processes simultaneously -- it would be wildly inefficient to have all TCP protocol traffic passed through a single process. Commented Sep 13, 2022 at 20:57
  • Do you want to find process(es) using TCP maybe? Commented Sep 13, 2022 at 20:58

2 Answers 2


TCP isn't a process, but a stack or subsystem inside the kernel. It doesn't have a "process id", as such, although kernel threads doing work as part of its operation may do. The work needed to perform the work of the TCP stack is spread across multiple kthreads, kernel stacks of userspace processes, and elsewhere.

To see kworkers on your machine, for example:

% pgrep -af kworker | head
24 kworker/1:0H-events_highpri
30 kworker/2:0H-events_highpri
36 kworker/3:0H-events_highpri
42 kworker/4:0H-kblockd
48 kworker/5:0H-events_highpri
54 kworker/6:0H-events_highpri
60 kworker/7:0H-events_highpri
120 kworker/1:1H-events_highpri
121 kworker/0:1H-kblockd
151 kworker/7:1H-events_highpri

Some of these are dedicated to particular kinds of work, and some are more generally scoped. Since the TCP stack involves not only the network, but also the CPU scheduler, memory, and other resources, many different parts of the kernel may eventually be abstractly involved in making forward progress in processing TCP packets.


I assume here you've looked at ps -aux | grep ssh and seen systems on the SSH port (TCP port 22) and thought that's the match. It's actually matching on the program name which is called ssh.

What's next really depends on what you are trying to do. To see all processes that are using TCP, the tool you want is ss.

ss -atnp is possibly what you are after. This will show all a sockets that are TCP t numerically n and the process that opened it p. You will need to be root or use sudo to see processes you don't own, such as a webserver or ssh server.

This command answers things like "who is connecting to remote site X" or "who has port 1234 open".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .