How to Check Service Running on Specific Port on Linux

Occasionally, we may need to check out the default port number of specific services/protocols or services listening on certain ports on Linux. A number of command line tools are available to help you search port names and numbers in your Linux System.

1) Using Netstat Command

Nestat command is a tool used for checking active network connections, interface statistics as well as the routing table. It's available in all Linux distributions. However, for minimal installations, you can install it by running

For RedHat and CentOS

sudo yum install net-tools

For Fedora 22 and later

dnf install net-tools

For Debian/Ubuntu

sudo apt-get install net-tools

Usage

To display detailed information of TCP and UDP endpoints run

netstat -pnltu

Output

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      13878/mysqld
tcp        0      0 127.0.0.1:11211         0.0.0.0:*               LISTEN      21487/memcached
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1208/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1032/master
tcp6       0      0 :::80                   :::*                    LISTEN      13625/httpd
tcp6       0      0 :::22                   :::*                    LISTEN      1208/sshd
tcp6       0      0 ::1:25                  :::*                    LISTEN      1032/master
udp        0      0 0.0.0.0:64561           0.0.0.0:*                           569/dhclient
udp        0      0 0.0.0.0:68              0.0.0.0:*                           569/dhclient
udp        0      0 127.0.0.1:323           0.0.0.0:*                           525/chronyd
udp6       0      0 :::11200                :::*                                569/dhclient
udp6       0      0 ::1:323                 :::*                                525/chronyd

• -p flag Gives the process ID and the process name.
• -n flag displays numerical addresses
• -l flag displays listening sockets
• -t flag shows TCP connections
• -u flag shows UDP connections

To find a service listening to a specific port run

netstat -pnltu | grep -i "80"

Output

tcp6       0      0 :::80                   :::*                    LISTEN      13625/httpd

Similarly, to find which port a service is listening on run

netstat -pnltu | grep -i "httpd"

Output

tcp6       0      0 :::80                   :::*                    LISTEN      13625/httpd

2) Using fuser Command

fuser command is used for displaying Process IDs of services running on specific ports.
It's not installed by default in most systems. To install it run

For RedHat and CentOS

yum install psmisc

ForFedoraa 22 and later

dnf install psmisc

For Debian and Ubuntu

apt-get install psmisc

For example, to find PIDs running on port 80 run,

fuser 80/tcp

Output

80/tcp:              13625 18390 18391 18392 18393 18394 18442 19926 24386

To search for process name using process PID run

ps -p 13625 -o comm=

Output

httpd

3) Using lsof Command

lsof command can be used to examine active TCP and UDP endpoints. To install the command line tool

For RedHat and CentOS

yum install lsof

ForFedoraa 22 and later

dnf install lsof

For Debian and Ubuntu

apt-get install lsof

To display active TCP and UDP endpoints with lsof run ,

lsof -i

Output

COMMAND     PID      USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
chronyd     525    chrony    1u  IPv4    14681      0t0  UDP localhost:323
chronyd     525    chrony    2u  IPv6    14682      0t0  UDP localhost:323
dhclient    569      root    6u  IPv4    15731      0t0  UDP *:bootpc
dhclient    569      root   20u  IPv4    15720      0t0  UDP *:64561
dhclient    569      root   21u  IPv6    15721      0t0  UDP *:11200
master     1032      root   13u  IPv4    17345      0t0  TCP localhost:smtp (LISTEN)
master     1032      root   14u  IPv6    17346      0t0  TCP localhost:smtp (LISTEN)
sshd       1208      root    3u  IPv4    18639      0t0  TCP *:ssh (LISTEN)
sshd       1208      root    4u  IPv6    18641      0t0  TCP *:ssh (LISTEN)
sshd       7749      root    3u  IPv4 11570561      0t0  TCP ip-172-31-16-136.us-east-2.compute.internal:ssh->197.232.61.206:51088 (ESTABLISHED)
sshd       7752  ec2-user    3u  IPv4 11570561      0t0  TCP ip-172-31-16-136.us-east-2.compute.internal:ssh->197.232.61.206:51088 (ESTABLISHED)
httpd     13625      root    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
mysqld    13878     mysql   14u  IPv4  7277635      0t0  TCP *:mysql (LISTEN)
httpd     18390    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
httpd     18391    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
httpd     18392    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
httpd     18393    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
httpd     18394    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
httpd     18442    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
httpd     19926    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)
memcached 21487 memcached   26u  IPv4  6250352      0t0  TCP localhost:memcache (LISTEN)
httpd     24386    apache    4u  IPv6  7277180      0t0  TCP *:http (LISTEN)

To display processes /services listening on a particular port, type the command below as you specify the port

lsof -i :80

COMMAND   PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
httpd   13625   root    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   18390 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   18391 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   18392 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   18393 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   18394 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   18442 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   19926 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)
httpd   24386 apache    4u  IPv6 7277180      0t0  TCP *:http (LISTEN)

4) Using Whatportis Tool

Whatportis is a command line tool that allows you to search port names and numbers of services running in your system. The tool fetches the list of official TCP/UDP ports from iana website.  As a result, a  private script is created to regularly fetch the website and update the ports.json fileTo use the command line tool, we must first of all, install it in our system.
First, we need to install python-pip

For Ubuntu 16 and later & Debian Systems

apt install python-pip

For RHEL & CentOS Systems

Install EPEL repository

yum install epel-release

Next, Install python setup tools

sudo yum install python34-setuptools

Install pip

sudo easy_install-3.4 pip

Finally, install whatportis using pip

pip install whatportis

Usage of  Whatportis

To search for a port associated with a service name run

whatportis service-name

For example

whatportis ssh

Conversely, you can search for the service associated with the port number

whatportis 22

You can also search a pattern without knowing the exact name by running

whatportis ssh --like

You can also display results as JSON output

whatportis 22 --json

Read also

• How to Enable or Disable Services in Ubuntu Systemd/Upstart

That's all we had for today. As always we cherish your thoughts and your feedback is always welcome. Feel free to reach us via the comment section below. Thank you for your time and stay tuned for more informative tutorials.