342

I suspect a program is listening on port 8000 on my machine.

When I run the following command, I get this error:

> python -m SimpleHTTPServer
# Lots of python error
socket.error: [Errno 98] Address already in use

If I use another port (8000 is the default), the web server runs fine.

If I run wget localhost:8000 from the command line, it returns 404 Not Found.

What can I do (or what tools are available) to find what program is listening on port 8000, and from there where that program is configured?

257

Open your terminal and type as

lsof -i :8000

that command will list you the application used by that port with PID. (If no results run via sudo since your might have no permission to certain processes.)

For example, with port 8000 (python3 -m http.server):

$ lsof -i :8000
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
python3 3269 user    3u  IPv4 1783216      0t0  TCP *:8000 (LISTEN)

And port 22 (SSH):

$ sudo lsof -i :22
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd     998 root    3u  IPv4 1442116      0t0  TCP *:ssh (LISTEN)
sshd     998 root    4u  IPv6 1442118      0t0  TCP *:ssh (LISTEN)

Hope that helps.

  • 2
    This also works on OSX for what its worth..... – reevesy Mar 11 '14 at 12:36
  • 2
    Adding -s TCP:LISTEN restricts the result to the actual listening socket and its process. – jhermann May 12 '15 at 14:27
  • If you search for port 8000 it returns PID 1889? wat – CodyBugstein Oct 1 '15 at 21:19
  • Yes , there is service with PID 1889 using port 8881. am I missing anything ? – rɑːdʒɑ Oct 5 '15 at 11:26
  • 1
    @Imray the example searches for port 8881. The PID column contains the process IDs and the NAME column contains the ports. – Freek de Bruijn Oct 11 '15 at 8:42
363

You can use netstat to see which process is listening on which port.

You can use this command to have a full detail :

sudo netstat -peanut

if you need to know exactly which one is listening on port 8000 you can use this :

sudo netstat -peanut | grep ":8000 "

There is no process that can hide from netstat.

  • 108
    netstat -peanut is easier to remember than netstat -taupen! – Douglas B. Staple Aug 31 '15 at 12:34
  • 8
    Good one ! - Just edited the answer in order to reflect your comment. Thank you. – Antoine Rodriguez Sep 1 '15 at 16:48
  • 2
    'fuser -k 8000/tcp' to free that port – Jay Modi Feb 19 '16 at 13:00
  • 3
    if in column "PID/Program name" you see dashes instead of a process name, you forgot to add "sudo" – v.shashenko Feb 9 '17 at 11:29
  • 3
    so it's peanuts eh – prusswan Feb 22 '17 at 3:16
170

To expound on the answer by @33833 you can get some very detailed info, for example:

$ lsof -i :8000
COMMAND  PID  USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
squid3  1289 proxy   15u  IPv6 14810490      0t0  TCP *:8000 (LISTEN)

$ ps -fp 1289
UID        PID  PPID  C STIME TTY          TIME CMD
proxy     1289     1  0 09:48 ?        00:00:00 /usr/sbin/squid3 -N -f /etc/squid-deb-proxy/squid-deb-proxy.conf

I can see right there that squid is the process, but it is actualy my squid-deb-proxy that is taking up the port.

Another good example of a java app:

$ lsof -i :4242
COMMAND  PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
java    3075 root   86u  IPv4    12019      0t0  TCP *:4242 (LISTEN)

$ ps -fp 3075
UID        PID  PPID  C STIME TTY          TIME CMD
root      3075     1 15 May24 ?        3-16:07:25 /usr/local/crashplan/jre/bin/java -Dfile.encoding=UTF-8 -Dapp=CrashPlanService -DappBaseName=CrashPl

You can see in lsof (LiSt Open Files) that it is java, which is less than helpful. Running the ps command with the PID we can see right away that it is CrashPlan.

  • 9
    In one command: lsof -t -i :8000 | xargs ps -fp – Brett Y Aug 13 '14 at 23:41
  • 8
    I had to prefix sudo but after that it worked for me. Thanks. – Dwayne Crooks Sep 10 '16 at 21:25
  • 4
    note: without sudo you won't get an error, you simple will get nothing as a response. – Frank Nocke Jan 6 '17 at 10:52
13

Try ss from iproute2 package:

ss -nlp | grep 8000
  • 4
    ss also has its own filtering capabilities: ss -nlp '( sport = :8000 )'. – GnP Dec 9 '14 at 21:21
6

Another way using socklist from procinfo package:

man socklist

DESCRIPTION
socklist is a Perl script that gives you a list of all open sockets, enumerating types, port, inode, uid, pid, fd and the program to which it belongs.

sudo socklist

type  port      inode     uid    pid   fd  name
tcp     53      28749       0   1721    5  dnsmasq
tcp    631      29190       0   2433   11  cupsd
tcp  42376      82230    1000   1345   84  firefox
tcp  49048      71686    1000   1345   67  firefox
tcp  41248      81672    1000   1345  119  firefox
tcp  54676      84558    1000   1345   73  firefox
udp  56107      66258       0   3268   20  dhclient
udp  40804      17857     107    679   14  avahi-daemon
udp     53      28748       0   1721    4  dnsmasq
udp     68      67427       0   3268    6  dhclient
udp    631      19692       0    765    8  cups-browsed
udp   5353      17855     107    679   12  avahi-daemon
2

You can use nmap.

It is really important to know which ports are open in your PC, this is not only useful for Linux, but also for other operating systems, Linux has a lot of tools to check which ports are open, the most common is nmap which is a command line tool, but also exist a Graphical frontEnd for it if you prefer that way.1

to install it, just press Ctrl+Alt+T on your keyboard to open Terminal. When it opens, run the command below:

sudo apt-get install nmap

For more information about nmap, and other utilities, go Here

1Source:garron.me

  • nmap will only tell you THAT a port is open, not which process opened it. – Andrew Burns Jun 17 '14 at 15:49
  • 1
    I clicked through to your source to read [nmap] tries to guess which service is listening on each port, but it can make mistakes right before it suggests an actual method to find out which process owns the socket. – GnP Dec 9 '14 at 21:24
  • @gnp You may also want to take a look at This. – Mitch Dec 10 '14 at 6:15
  • @Mitch I did. The OP needs to know the exact PID of a process on the local system. Nmap is not the right tool here, not even with service and version detection. Either it will match an item on nmaps database, which still lets OP on the dark as to what process to kill or reconfigure, or it won't and OP will have a nice fingerprint and a link to insecure.org – GnP Dec 10 '14 at 14:10

protected by Thomas Ward Mar 30 '18 at 13:54

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.