Check which process is listening on a given port

Overview

When a port is already taken or a service misbehaves, the first diagnostic step is finding which process owns the listening socket. Both Windows and Linux expose this from the command line through several tools, from classic netstat to modern replacements (Get-NetTCPConnection, ss) down to reading the kernel's own tables by hand.

Key points

• On both platforms, resolving the owning process of someone else's socket generally requires elevation (admin prompt on Windows, sudo on Linux).
• Windows: netstat -ano is always there; PowerShell Get-NetTCPConnection is the modern structured way; tcpvcon (Sysinternals) when you want TCPView without a GUI.
• Linux: ss (iproute2) is the current default; netstat is legacy (net-tools); lsof and fuser answer from the file-descriptor side; /proc/net/tcp is the raw source all of them read.
• Port numbers in /proc/net/tcp are hexadecimal — convert with printf '%04X'.

Details

Windows

1. netstat + tasklist (classic cmd):

   netstat -ano | findstr :8080
   tasklist /FI "PID eq 1234"
   

   -a all connections, -n numeric, -o owning PID; tasklist resolves the PID to a name.

2. netstat -b — shows the executable directly (elevated prompt required):

   netstat -abno | findstr /C:":8080"
   

3. PowerShell Get-NetTCPConnection (modern, structured output):

   Get-NetTCPConnection -LocalPort 8080 -State Listen | Select LocalAddress,LocalPort,OwningProcess
   

4. PowerShell one-liner resolving straight to the process object:

   Get-Process -Id (Get-NetTCPConnection -LocalPort 8080 -State Listen).OwningProcess
   

5. Sysinternals tcpvcon (CLI TCPView):

   tcpvcon -a | findstr 8080
   

Linux

1. ss (iproute2, the modern default):

   ss -ltnp 'sport = :8080'    # -l listening, -t tcp, -n numeric, -p process
   

2. lsof:

   sudo lsof -nP -iTCP:8080 -sTCP:LISTEN
   

3. fuser:

   sudo fuser -v 8080/tcp      # prints PID + user; -k would kill the owner
   

4. netstat (legacy, package net-tools):

   sudo netstat -tulpn | grep :8080
   

5. procfs by hand (no tools needed — what the others read under the hood):

   grep -i ":$(printf '%04X' 8080)" /proc/net/tcp    # socket inode is column 10
   sudo ls -l /proc/*/fd 2>/dev/null | grep 'socket:\[<inode>\]'   # PID holding it
   

Related

• Hardening Linux — same territory: knowing what listens on a box is step one of locking it down.