Which process is using a port, and how to free it

Find the program behind a busy port with ss, lsof or fuser, decide whether to stop it properly or kill it, and avoid the trap of killing the wrong thing.

LevelBeginner
What kind of helpStep by step
Works onLinux macOS

Drafted with AI from official documentation. Scripts were run in a test environment and repository links verified. Awaiting a human check. Did it work for you? Last edited 15 Oct 2026 Outdated?

Edit history · 1 edit

Type: Article
Edits: 1
Editors: 1
First issued: 15 Oct 2026
Last edit: 15 Oct 2026
Reading: 2 min

Your app refuses to start with Address already in use, or a port that should be closed is answering. In both cases the question is the same: which process owns that port? The answer takes one command; the right way to free it depends on what you find.

Find the process

Check before you run this

Runs with administrator rights. Make sure you understand every line.

# Linux, preferred
sudo ss -ltnp 'sport = :8080'

# Linux and macOS
sudo lsof -nP -iTCP:8080 -sTCP:LISTEN

# Linux, shortest form (from the psmisc package)
sudo fuser 8080/tcp

Run these with sudo: without it you only see processes owned by your own user and the process column stays empty. In ss output the users:(("node",pid=4321,fd=18)) part gives the program name and PID. For UDP replace -ltnp with -lunp and -iTCP with -iUDP.

Once you have a PID, learn what it actually is before touching it:

ps -o pid,user,etime,cmd -p 4321
systemctl status 4321          # Linux: tells you which systemd unit, if any, owns the PID
docker ps --filter publish=8080   # a container may be publishing the port

Free it the right way

How you stop it depends on who started it:

A systemd service (status shows a unit name): sudo systemctl stop nginx. If you kill the process instead, systemd may restart it immediately.
A Docker container: docker stop NAME, or change the published port in your compose file.
Your own earlier run left in another terminal or a tmux session: switch there and press Ctrl-C, or kill 4321.
Something you do not recognize: do not kill it yet. Read its command line and its parent (ps -o ppid= -p 4321). An unknown listener on a public server is worth understanding.

Check before you run this

Runs with administrator rights. Make sure you understand every line.

kill 4321            # polite: SIGTERM, lets the program clean up
sleep 2
kill -9 4321         # only if it is still there: SIGKILL cannot be ignored

sudo fuser -k 8080/tcp   # Linux shortcut: SIGKILL every process on that port

Prefer the plain kill first. SIGKILL skips cleanup, which can leave lock files or half-written data behind, and for databases it can mean a recovery run on the next start.

If no process shows up but the port is still busy

The socket may be in TIME_WAIT from a connection that just closed. ss -tan 'sport = :8080' shows it. It clears by itself within a minute; servers can set SO_REUSEADDR to bind anyway.
On Linux, a service may be socket-activated: systemd itself holds the port and starts the program on the first connection. systemctl list-sockets shows these; stop the .socket unit, not just the service.
Inside a container or a different network namespace you only see that namespace. Run the command on the host, or with nsenter.

Use a different port instead

Often the simplest fix is not freeing the port at all. Most development servers accept a port option (PORT=3001 npm start, python3 -m http.server 8001, uvicorn app:app --port 8001). Two things that both want port 80 is a configuration decision, not a process to kill.

Official documentation

Did this work for you?

No votes yet. Be the first.

If it did not work, the report form below tells the editors what went wrong.

Repos in the wild

firewalld: zone-based firewall daemon firewalld/firewalld Upstream source of firewalld, the default firewall manager on RHEL, Rocky Linux, AlmaLinux and Fedora, including firewall-cmd and its service definitions. GitHub
Pi-hole: network-wide ad blocking with your own DNS server pi-hole/pi-hole A DNS server for your home or office network that answers queries for known advertising and tracking domains with nothing, so every device on the network is protected without installing anything on it. GitHub
Nmap: the network mapper for inventorying your own network nmap/nmap Nmap is the long-standing open source tool for discovering hosts, open ports, services and operating systems on a network you administer, used to inventory systems and verify that firewall rules behave as intended. GitHub

History

Every saved edit is kept. The plot on the sleeve draws one line per edit. Open any edit to see exactly what changed.

15 Oct 2026 Dominik +2,924 chars

Report a problem

Something wrong, unsafe or copied? Tell the editors.