Say that you notice UDP port 323 is open (perhaps via netstat -lun) and you’ve no idea what that is!
With lsof it’s easy to find out which process is guilty:
[15:27 chris ~]$ sudo lsof -i :323
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
chronyd 1044 chrony 1u IPv4 19197 0t0 UDP localhost:323
chronyd 1044 chrony 2u IPv6 19198 0t0 UDP localhost:323
In this case, it’s chrony, the modern time keeping daemon.
As Jonh pointed out in the comments, you can also use netstat with the -p flag.
For example, show all processes listening (-l) on both TCP (-t) and UDP (-u) by port number (-n) showing the process (-p), while I grep for port 323 to show what’s running:
[19:08 chris ~]$ sudo netstat -lutnp |grep 323
udp 0 0 127.0.0.1:323 0.0.0.0:* 1030/chronyd
udp6 0 0 ::1:323 :::* 1030/chronyd
3 thoughts on “How to find out which process is listening on a port”
netstat has the ‘p’ command line flag for that as well
That’s true, I’ll update to add that. Thanks.