How to Find Which Process Is Using a Port

This guide shows you how to identify the exact process (program or service) that is listening on a specific TCP or UDP port on your computer. You’ll learn the commands for Windows, macOS, and Linux, and how to interpret the results to stop or manage the offending process.

What You’ll Need

• Access to a terminal or command prompt (on Windows, use Command Prompt or PowerShell; on macOS/Linux, use Terminal).
• Administrator or root privileges (required in many cases to see all processes and to kill them).
• Knowledge of the port number you want to investigate (e.g., 8080, 3306, 3000).

Step-by-Step

1. Open your command-line tool. On Windows, press Win+R, type cmd or powershell, and press Enter. On macOS, open Terminal from Applications/Utilities. On Linux, open your preferred terminal emulator.
2. List all active network connections with their process IDs (PIDs).
   • Windows: Run netstat -ano. The -a shows all connections and listening ports, -n displays addresses and port numbers in numerical form, and -o shows the owning process ID.
   • macOS/Linux: Run lsof -i (requires lsof, which is preinstalled on macOS and most Linux distributions). Alternatively, use netstat -tulpn (on Linux) or netstat -anv (on macOS) to see PIDs.
3. Find the specific port in the output. Look for the line where the local address shows 0.0.0.0:PORT or [::]:PORT (for IPv6). The port number appears after the colon. For example, 0.0.0.0:8080 means port 8080 is being used.
4. Note the PID (Process Identifier). On Windows, the last column of the netstat output is the PID. On macOS/Linux with lsof, the PID is in the second column (under PID). With netstat on Linux, the PID is shown after the program name, e.g., 1234/nginx.
5. Identify the process name using the PID.
   • Windows: Run tasklist | findstr <PID> (replace <PID> with the actual number). This shows the executable name.
   • macOS: Run ps -p <PID> -o comm= to get the command name.
   • Linux: Run ps -p <PID> -o comm= or ls -l /proc/<PID>/exe to see the full path of the executable.
6. If you need to stop the process (be careful – this will terminate the program):
   • Windows: Run taskkill /PID <PID> /F (force kill).
   • macOS/Linux: Run kill <PID> (graceful) or kill -9 <PID> (force).

Common Mistakes

• Using the wrong command for your OS. For example, netstat -ano works on Windows but not on macOS (which uses -anv). Always check your platform’s syntax.
• Forgetting to run as administrator/root. Without elevated privileges, you may not see all processes or be able to kill them. On Windows, right-click the command prompt and choose “Run as administrator”; on macOS/Linux, prefix commands with sudo when needed.
• Confusing listening ports with established connections. A port can be in “LISTENING” state (server waiting for connections) or have active connections. The process that owns the listening socket is the one using the port.
• Assuming the PID is the same across reboots. PIDs are temporary; they change every time a process starts. Always re-check if you reboot.

Tips

• Filter the output to make it easier to find your port. On Windows, use netstat -ano | findstr :8080. On macOS/Linux, use lsof -i :8080 (this directly shows only that port).
• Use the lsof command on macOS/Linux because it gives you the process name directly, saving a step.
• For a quick check on Windows, you can use netstat -ano | findstr LISTENING to see only listening ports.
• If you’re a developer, consider using a GUI tool like TCPView (Windows) or lsof with a graphical front-end, but the command line is always reliable.

Troubleshooting

I don’t see the port in the netstat output. The port might be closed (no process listening) or the connection is transient. Try again after a few seconds. Also, ensure you’re looking at the correct protocol (TCP vs UDP) – some ports are UDP-only.

I see the PID but tasklist or ps doesn’t show it. The process may have ended between the two commands. Re-run netstat to confirm. Alternatively, the process might be a system process (PID 0, 4, etc.) that requires elevated privileges to view.

Permission denied when trying to kill the process. You need to run the kill command with sudo (macOS/Linux) or as Administrator (Windows). If it still fails, the process may be protected by the OS – you may need to disable the service instead.

The port shows as being used by PID 0 or PID 4 (Windows). PID 0 is the System Idle Process, and PID 4 is the System process. These are often kernel-level services. To identify the specific service, use netstat -b (requires admin) to see the executable name, or use the Resource Monitor (resmon) GUI.

Frequently Asked Questions

Q: What is the difference between TCP and UDP ports?
A: TCP (Transmission Control Protocol) is connection-oriented (reliable, ordered), while UDP (User Datagram Protocol) is connectionless (faster, no guarantee). Most web services use TCP, but some (like DNS) use UDP. The commands above show both; make sure you’re checking the right protocol.

Q: Can two processes use the same port?
A: Not simultaneously on the same IP address and protocol. The OS enforces uniqueness. If you see multiple PIDs, they are likely using different IPs (e.g., IPv4 vs IPv6) or different protocols.

Q: How do I find which process is using a port on a remote server?
A: You need to SSH into the server and run the same commands (netstat, lsof). There is no direct way to query a remote machine’s port usage from your local machine without special tools.

Q: What if I don’t have administrator rights?
A: You can still see connections for your own processes, but you may not see system services. You also cannot kill processes you don’t own. Contact your system administrator for help.

Q: Why does the port show as being used by multiple PIDs?
A: This can happen when a process has multiple threads, or when a parent process and child processes share the same listening socket (common in web servers like Apache). The main process is usually the one with the lowest PID or the one listed first.

Q: How do I free up a port without killing the process?
A: You can’t – the process is using it. You can either stop the process, or reconfigure the application to use a different port. Killing the process is the only direct way to release the port.

Related

• Breathe HR Leave Calculator: How It Works
• Bike to Work Calculator: Savings & CO2
• Bit Error Rate Calculator: Formula & How to Use