539

I suspect a program is listening on port 8000 on my machine.

When I run the following command, I get this error:

> python -m SimpleHTTPServer
# Lots of python error
socket.error: [Errno 98] Address already in use

If I use another port (8000 is the default), the web server runs fine.

If I run wget localhost:8000 from the command line, it returns 404 Not Found.

What can I do (or what tools are available) to find what program is listening on port 8000, and from there where that program is configured?

Improve this question

8 Answers 8

Reset to default
537

Open your terminal and type as 

lsof -i :8000

that command will list you the application used by that port with PID. (If no results run via sudo since your might have no permission to certain processes.)

For example, with port 8000 (python3 -m http.server):

$ lsof -i :8000
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
python3 3269 user    3u  IPv4 1783216      0t0  TCP *:8000 (LISTEN)

And port 22 (SSH):

$ sudo lsof -i :22
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd     998 root    3u  IPv4 1442116      0t0  TCP *:ssh (LISTEN)
sshd     998 root    4u  IPv6 1442118      0t0  TCP *:ssh (LISTEN)

Hope that helps.

Improve this answer
7
  • 7
    This also works on OSX for what its worth.....
    – reevesy
    Mar 11, 2014 at 12:36
  • 8
    Adding -s TCP:LISTEN restricts the result to the actual listening socket and its process.
    – jhermann
    May 12, 2015 at 14:27
  • 2
    If you search for port 8000 it returns PID 1889? wat
    – CodyBugstein
    Oct 1, 2015 at 21:19
  • 1
    Yes , there is service with PID 1889 using port 8881. am I missing anything ?
    – Raja G
    Oct 5, 2015 at 11:26
  • 2
    @Imray the example searches for port 8881. The PID column contains the process IDs and the NAME column contains the ports.
    – Freek de Bruijn
    Oct 11, 2015 at 8:42
458

You can use netstat to see which process is listening on which port.

You can use this command to have a full detail :

sudo netstat -peanut

if you need to know exactly which one is listening on port 8000 you can use this :

sudo netstat -peanut | grep ":8000 "

There is no process that can hide from netstat.

Improve this answer
9
  • 159
    netstat -peanut is easier to remember than netstat -taupen!
    – Douglas B. Staple
    Aug 31, 2015 at 12:34
  • 14
    Good one ! - Just edited the answer in order to reflect your comment. Thank you.
    – Antoine Rodriguez
    Sep 1, 2015 at 16:48
  • 5
    'fuser -k 8000/tcp' to free that port
    – Jay Modi
    Feb 19, 2016 at 13:00
  • 5
    if in column "PID/Program name" you see dashes instead of a process name, you forgot to add "sudo"
    – v.shashenko
    Feb 9, 2017 at 11:29
  • To kill/end the process use kill <PID> where <PID> is the process id displayed in the last column of netstat's output. Eg. kill 31612.
    – totymedli
    Jul 28, 2017 at 16:28
184

To expound on the answer by @33833 you can get some very detailed info, for example:

$ lsof -i :8000
COMMAND  PID  USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
squid3  1289 proxy   15u  IPv6 14810490      0t0  TCP *:8000 (LISTEN)

$ ps -fp 1289
UID        PID  PPID  C STIME TTY          TIME CMD
proxy     1289     1  0 09:48 ?        00:00:00 /usr/sbin/squid3 -N -f /etc/squid-deb-proxy/squid-deb-proxy.conf

I can see right there that squid is the process, but it is actualy my squid-deb-proxy that is taking up the port.

Another good example of a java app:

$ lsof -i :4242
COMMAND  PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
java    3075 root   86u  IPv4    12019      0t0  TCP *:4242 (LISTEN)

$ ps -fp 3075
UID        PID  PPID  C STIME TTY          TIME CMD
root      3075     1 15 May24 ?        3-16:07:25 /usr/local/crashplan/jre/bin/java -Dfile.encoding=UTF-8 -Dapp=CrashPlanService -DappBaseName=CrashPl

You can see in lsof (LiSt Open Files) that it is java, which is less than helpful. Running the ps command with the PID we can see right away that it is CrashPlan.

Improve this answer
3
  • 13
    In one command: lsof -t -i :8000 | xargs ps -fp
    – Brett Y
    Aug 13, 2014 at 23:41
  • 9
    I had to prefix sudo but after that it worked for me. Thanks.
    – Dwayne Crooks
    Sep 10, 2016 at 21:25
  • 5
    note: without sudo you won't get an error, you simple will get nothing as a response.
    – Frank N
    Jan 6, 2017 at 10:52
17

Try ss from iproute2 package:

ss -nlp | grep 8000
Improve this answer
1
  • 8
    ss also has its own filtering capabilities: ss -nlp '( sport = :8000 )'.
    – GnP
    Dec 9, 2014 at 21:21
10

Due to low point in community, I can't comment here. Without sudo all above commands will not provide you Process Id / Program Name.

So, you need type following things:

sudo lsof -i :8000

or 

sudo netstat -lntup

you can check those command details via man, help or my favorite helper

Improve this answer
9

Another way using socklist from procinfo package:

man socklist

DESCRIPTION
socklist is a Perl script that gives you a list of all open sockets, enumerating types, port, inode, uid, pid, fd and the program to which it belongs.

sudo socklist 

type  port      inode     uid    pid   fd  name
tcp     53      28749       0   1721    5  dnsmasq
tcp    631      29190       0   2433   11  cupsd
tcp  42376      82230    1000   1345   84  firefox
tcp  49048      71686    1000   1345   67  firefox
tcp  41248      81672    1000   1345  119  firefox
tcp  54676      84558    1000   1345   73  firefox
udp  56107      66258       0   3268   20  dhclient
udp  40804      17857     107    679   14  avahi-daemon
udp     53      28748       0   1721    4  dnsmasq
udp     68      67427       0   3268    6  dhclient
udp    631      19692       0    765    8  cups-browsed
udp   5353      17855     107    679   12  avahi-daemon
Improve this answer
2

You can use nmap.

It is really important to know which ports are open in your PC, this is not only useful for Linux, but also for other operating systems, Linux has a lot of tools to check which ports are open, the most common is nmap which is a command line tool, but also exist a Graphical frontEnd for it if you prefer that way.1

to install it, just press Ctrl+Alt+T on your keyboard to open Terminal. When it opens, run the command below:

sudo apt-get install nmap

For more information about nmap, and other utilities, go Here

1Source:garron.me

Improve this answer
4
  • nmap will only tell you THAT a port is open, not which process opened it.
    – Andrew Burns
    Jun 17, 2014 at 15:49
  • 1
    I clicked through to your source to read [nmap] tries to guess which service is listening on each port, but it can make mistakes right before it suggests an actual method to find out which process owns the socket.
    – GnP
    Dec 9, 2014 at 21:24
  • @gnp You may also want to take a look at This.
    – Mitch
    Dec 10, 2014 at 6:15
  • @Mitch I did. The OP needs to know the exact PID of a process on the local system. Nmap is not the right tool here, not even with service and version detection. Either it will match an item on nmaps database, which still lets OP on the dark as to what process to kill or reconfigure, or it won't and OP will have a nice fingerprint and a link to insecure.org
    – GnP
    Dec 10, 2014 at 14:10
1

Here is an easy to remember command

ss -townlup 

Netid               State                 Recv-Q                Send-Q                                    Local Address:Port                               Peer Address:Port
icmp6               UNCONN                0                     0                                                *%eth0:58                                            *:*
udp                 UNCONN                0                     0                                         127.0.0.53%lo:53                                      0.0.0.0:*
udp                 UNCONN                0                     0                                     172.31.26.71%eth0:68                                      0.0.0.0:*
tcp                 LISTEN                0                     128                                             0.0.0.0:22                                      0.0.0.0:*
tcp                 LISTEN                0                     128                                             0.0.0.0:443                                     0.0.0.0:*
tcp                 LISTEN                0                     128                                       127.0.0.53%lo:53                                      0.0.0.0:*
tcp                 LISTEN                0                     128                                                [::]:22                                         [::]:*
tcp                 LISTEN                0                     128                                                [::]:443                                        [::]:*
tcp                 LISTEN                0                     100                                                   *:9090                                          *:*                    users:(("java",pid=13008,fd=16))
tcp                 LISTEN                0                     100                                                   *:8080                                          *:*                    users:(("java",pid=11556,fd=12))
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .