Check What Service is Listening on a Specific Port on Linux

In this guide from the Linux Tutorials, we want to teach you How To Check or Find What Service or Program is Listening on a Specific TCP Port on Linux.

A port is an addressable network location implemented in an operating system to help differentiate traffic destined for different services or applications. A port is always associated with an IP address of a host and the protocol type for the communication.

A service is said to be “listening” on a port when it is binding to a port/protocol/IP address combination in order to wait for requests from clients of the service. Upon receipt of the request, it establishes a one-to-one server-client dialog using the same port number.

what you read in this post?

Steps To Check or Find What Service or Program is Listening on a Specific TCP Port on Linux

Steps To Check or Find What Service or Program is Listening on a Specific TCP Port on Linux

If you face these questions:

How do I find out which service is listening on a specific port?

How do I find out what program is listening on a specific TCP Port?

At this point, you can follow the steps below to get your answer.

Use lsof command To Find the Listening Specific Port on Linux

lsof command stands for List Of Open Files. This command provides a list of files that are opened. Basically, it gives the information to find out the files which are opened by which process.

To see IPv4 Ports, you can use the command below:

lsof -Pnl +M -i4

Example output:

Output
COMMAND     PID     USER   FD   TYPE    DEVICE   SIZE/OFF   NODE NAME
chronyd         540      996    6u    IPv4      16341           0t0   UDP 127.0.0.1:323
sshd              601        0     5u     IPv4      17158           0t0  TCP *:22 (LISTEN)
postmaste      623       26    7u     IPv4      17305           0t0  TCP 127.0.0.1:5432 (LISTEN                                                                                                                                                             )
sshd              12182     0    5u      IPv4     244234         0t0  TCP *:22->*:63573 (ESTABLISHED)
sshd              12200     0    5u      IPv4     244234         0t0  TCP *:22->*:63573 (ESTABLISHED)

To see IPv6 ports, you can use the following command:

lsof -Pnl +M -i6

Example output:

Output
COMMAND   PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
chronyd      540      996    7u    IPv6  16342      0t0  UDP [::1]:323
sshd           601        0     7u     IPv6  17160      0t0  TCP *:22 (LISTEN)
postmaste   623       26     6u    IPv6  17304      0t0  TCP [::1]:5432 (LISTEN)

As you can see, from the output, you will get information about which service is listening on a specific port.

For more information about the lsof command, you can use the command below:

man lsof

Use netstat command To Find the Listening Specific Port on Linux

At this point, you can use the netstat command to get information about the service port on Linux.

The netstat command, meaning network statistics, is a Command Prompt command used to display very detailed information about how your computer is communicating with other computers or network devices.

Specifically, it can show details about individual network connections, overall and protocol-specific networking statistics, and much more, all of which could help troubleshoot certain kinds of networking issues.

To do this, you can use the commands below:

# netstat -tulpn
Or
# netstat -npl

Example Output:

Output
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp            0          0  0.0.0.0:22              0.0.0.0:*               LISTEN      601/sshd
tcp            0          0 127.0.0.1:5432        0.0.0.0:*               LISTEN      623/postmaster
tcp6          0          0 :::22                         :::*                    LISTEN        601/sshd
tcp6          0          0 ::1:5432                    :::*                    LISTEN      623/postmaster
udp           0          0 127.0.0.1:323          0.0.0.0:*                               540/chronyd
udp6         0          0 ::1:323                     :::*                                     540/chronyd

The last column PID/Program name gives out information regarding the program name and port.

At this point, to get more information about the netstat command, you can use the man page:

man netstat

Use /etc/services File

The /etc/services file is used by applications to translate human-readable service names into port numbers when connecting to a machine across a network. The file will typically include the service name, port/protocol, any aliases, and comments.

To do this, you can use the following commands:

$ cat /etc/services
$ grep 110 /etc/services
$ less /etc/services

Example Output:

Output
tcpmux          1/tcp                           # TCP port service multiplexer
tcpmux          1/udp                           # TCP port service multiplexer
rje             5/tcp                           # Remote Job Entry
rje             5/udp                           # Remote Job Entry
echo            7/tcp
echo            7/udp
discard         9/tcp           sink null
discard         9/udp           sink null
systat          11/tcp          users
systat          11/udp          users
daytime         13/tcp
daytime         13/udp
qotd            17/tcp          quote
qotd            17/udp          quote
chargen         19/tcp          ttytst source
chargen         19/udp          ttytst source
ftp-data        20/tcp
ftp-data        20/udp
# 21 is registered to ftp, but also used by fsp
ftp             21/tcp
ftp             21/udp          fsp fspd
ssh             22/tcp                          # The Secure Shell (SSH) Protocol
ssh             22/udp                          # The Secure Shell (SSH) Protocol
...