How to Find and Kill Processes Occupying a Port (lsof, netstat, ss)

When trying to start a server or an application, you might encounter an error message like “Address already in use.” This means the port your application needs is already being occupied by another process.

In this guide, we will cover how to identify which process is holding a port and how to terminate it using lsof, netstat, and the modern command ss.

Note for Ubuntu Users

While ss is installed by default on almost all modern Ubuntu versions (16.04+), lsof and netstat might be missing, especially in minimal installations or Docker containers.

If you see a “command not found” error, you can install them using:

sudo apt update
sudo apt install net-tools lsof

1. Using lsof (List Open Files)

lsof is often the most intuitive tool for this job. It lists open files and the processes that opened them. Since network sockets are treated as files in Linux, this command is perfect for tracking down ports.

Note: You should run these commands with sudo to ensure you can see processes owned by other users.

Common Options:

• -i: Selects the listing of files where the Internet address matches.
• -n: Inhibits the conversion of network numbers to host names (faster).
• -P: Inhibits the conversion of port numbers to port names (e.g., shows 22 instead of ssh).

Example: Check who is using port 22

sudo lsof -i TCP:22 -n -P

Output:

COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd     1116 root   3u   IPv4 33907  0t0      TCP  *:22 (LISTEN)
sshd     1116 root   4u   IPv6 33909  0t0      TCP  *:22 (LISTEN)

Key takeaway: The process ID (PID) is 1116.

2. Using netstat (The Traditional Way)

netstat is a classic utility for printing network connections. However, on newer Linux distributions (like minimal CentOS 7+ or Ubuntu), it might not be installed by default as it is part of the deprecated net-tools package.

Common Options:

• -l: Show only listening sockets.
• -n: Show numerical addresses (don’t resolve DNS).
• -p: Show the PID and name of the program to which each socket belongs.

Example:

sudo netstat -lnp | grep ':22'

Output:

tcp        0      0 0.0.0.0:22              0.0.0.0:* LISTEN      1116/sshd
tcp6       0      0 :::22                   :::* LISTEN      1116/sshd

3. Using ss (The Modern Alternative)

The ss command is the modern successor to netstat. It is faster and comes pre-installed on almost all modern Linux systems as part of the iproute2 package.

Example:

sudo ss -lptn 'sport = :22'

• -l: Listening sockets.
• -p: Show processes.
• -t: TCP sockets.
• -n: Numeric.

How to Terminate the Process

Once you have the PID (from the examples above, it is 1116), you can terminate the process.

1. Try a graceful stop (SIGTERM)

Always try this first. It gives the process a chance to save data and close files.

sudo kill 1116

2. Force kill (SIGKILL)

If the process is stuck or refuses to close, use the -9 option to kill it immediately.

sudo kill -9 1116

Summary

To resolve a port conflict:

1. Find the PID:
   • sudo lsof -i :PORT -P (Recommended)
   • sudo ss -lptn 'sport = :PORT' (Modern)
   • sudo netstat -lnp | grep :PORT (Traditional)
2. Kill the process:
   • kill <PID>