🛠️ ITBlogs.pro

Which Process Is Using a Port on Linux? (ss, lsof, fuser)

Oct 16, 2026 · Networking · 2 min read

bind: Address already in use or EADDRINUSE means another process already owns the port. Here's how to find it in seconds.

The fastest way: ss

sudo ss -tlnp | grep ':8080'

Example output:

LISTEN 0  511  *:8080  *:*  users:(("nginx",pid=1423,fd=6))

The users:(...) part gives the program name and PID. What the flags mean:

Flag Meaning
-t TCP (use -u for UDP)
-l listening sockets only
-n show numbers, don't resolve names (faster)
-p show the owning process (needs sudo)

List everything that listens, which is also a good security check:

sudo ss -tulnp

Alternatives

sudo lsof -i :8080                 # who has port 8080 open
sudo lsof -iTCP -sTCP:LISTEN -P -n # all listening TCP ports
sudo fuser 8080/tcp                # prints PIDs using the port

Stop it

First find out what the process is, then stop it properly:

ps -fp 1423                        # what is PID 1423?
sudo systemctl stop nginx          # if it's a service (preferred)
kill 1423                          # polite request (SIGTERM)
kill -9 1423                       # last resort, no cleanup
sudo fuser -k 8080/tcp             # kill whatever uses the port

If a service keeps coming back, it's managed by systemd, so stop and disable it: sudo systemctl disable --now nginx.

"Nothing is listening" but it still fails

  • Docker: a container may publish the port. Run docker ps --format '{{.Names}} {{.Ports}}'.
  • systemd socket activation: the port belongs to systemd, not the service. Check systemctl list-sockets.
  • IPv4 vs IPv6: 127.0.0.1:8080 and [::1]:8080 are different sockets, and *:8080 covers both.
  • Port below 1024: needs root or CAP_NET_BIND_SERVICE.
  • A recently closed connection can hold the port in TIME_WAIT for up to a minute, so wait and retry.

The opposite problem: port is open locally but not reachable

Check the address it is bound to:

Shown as Reachable from
127.0.0.1:3306 this machine only
0.0.0.0:80 or *:80 any IPv4 interface
[::]:80 any IPv6 (and often IPv4) interface

If it's bound to 0.0.0.0 but still unreachable from outside, the problem is a firewall: check sudo ufw status and your cloud provider's firewall/security group. Test from another machine:

nc -zv SERVER_IP 8080
curl -v http://SERVER_IP:8080/

Windows equivalent

netstat -ano | findstr :8080
tasklist /FI "PID eq 1234"
taskkill /PID 1234 /F
linuxnetworkingsstroubleshooting