netstat, ss, lsof: Who's Using This Port?
Medium Priority50 min readUpdated August 14, 2026
A service fails to start with an error such as:
Another service appears healthy, but nothing is accepting connections on its expected port. A server has thousands of TCP connections, but it is unclear which process owns them. These problems begin with the same questions:
- Does the socket exist?
- Which local address and port does it use?
- What state is it in?
- Which process owns it?
On Unix-like systems, three command-line tools answer different parts of those questions:
ssis the primary Linux tool for inspecting socket state.netstatprovides similar information and remains useful on systems wheressis unavailable.lsofconnects sockets to processes and their open file descriptors.
These tools inspect the local host. They do not capture packets, query a remote machine, or prove that a listener is reachable through a firewall. Their strength is showing what the local kernel and local processes know at one instant.