Linux: Find Out What Is Using TCP Port 80

How do I find out what is listing or using tcp port number 80 on Linux based systems using command line options?

You can use any one of the following command to find out what is using tcp or udp port number 80 on Linux operating systems:
  1. netstat – a command-line tool that displays network connections, routing tables, and a number of network interface statistics.
  2. Tutorial details
    Difficulty level Easy
    Root privileges No
    Requirements None
    Est. reading time 1m
  3. fuser – a command line tool to identify processes using files or sockets.
  4. lsof – a command line tool to list open files under Linux / UNIX to report a list of all open files and the processes that opened them.
  5. /proc/$pid/ file system – Under Linux /proc includes a directory for each running process (including kernel processes) at /proc/PID, containing information about that process, notably including the processes name that opened port.


Open a terminal and then type the following command as root user:

netstat command find out what is using port 80

Type the following command
# netstat -tulpn | grep :80
OR pass the –color option to grep command as follows:
# netstat -tulpn | grep --color :80
Sample outputs:

tcp        0      0        *                   LISTEN      1215/nginx


  1. 0 – Source IP:Port
  2. 1215/nginx – PID/Process name

The tcp port 80 is opened and used by nginx web server. Type the following command to find out more about nginx:

whatis nginx
whereis nginx

Note: You may need to install lsof and fuser command.

Use /proc/$pid/exec file find out what is using port 80

First, find out the processes PID that opened tcp port 90, enter:
# fuser 80/tcp
Sample outputs:

80/tcp:              12161 21776 25250 25393

Finally, find out process name associated with PID # 3813, enter:
# ls -l /proc/12161/exe
Sample outputs:

lrwxrwxrwx. 1 root root 0 Aug  9 13:28 /proc/12161/exe -> /usr/sbin/lighttpd

Find out more about lighttpd:

man lighttpd
whatis lighttpd
whereis lighttpd

Sample outputs:

lighttpd             (8)  - a fast, secure and flexible web server
lighttpd: /usr/sbin/lighttpd /usr/lib64/lighttpd /usr/share/man/man8/lighttpd.8.gz

You can use package manager to dig into lighttpd:
# rpm -qa | grep lighttpd
Sample outputs:


To find out more about lighttpd-1.4.32-1.el6.x86_64 package, type:
# yum info lighttpd-1.4.32-1.el6.x86_64
Sample outputs:

Loaded plugins: auto-update-debuginfo, protectbase, rhnplugin, security
This system is receiving updates from RHN Classic or RHN Satellite.
0 packages excluded due to repository protections
Installed Packages
Name        : lighttpd
Arch        : x86_64
Version     : 1.4.32
Release     : 1.el6
Size        : 664 k
Repo        : installed
Summary     : A web server more optimized for speed-critical environments.
URL         :
License     : Revised BSD
Description : It is a secure and fast web server a very low memory footprint compared
            : to other webservers and takes care of cpu-load.

OR use rpm command:
# rpm -qi lighttpd
Sample outputs:

Name        : lighttpd                     Relocations: (not relocatable)
Version     : 1.4.32                            Vendor: nixCraft
Release     : 1.el6                         Build Date: Sun 03 Feb 2013 03:22:08 AM CST
Install Date: Mon 04 Feb 2013 04:44:26 AM CST      Build Host:
Group       : System Environment/Daemons    Source RPM: lighttpd-1.4.32-1.el6.src.rpm
Size        : 680402                           License: Revised BSD
Signature   : (none)
URL         :
Summary     : A web server more optimized for speed-critical environments.
Description :
It is a secure and fast web server a very low memory footprint compared
to other webservers and takes care of cpu-load.

Debian / Ubuntu Linux user can use the following commands:
# dpkg --list | grep lighttpd
# apt-cache search lighttpd
# apt-cache show lighttpd

Sample outputs from the last command:

Package: lighttpd
Priority: optional
Section: universe/web
Installed-Size: 841
Maintainer: Ubuntu Developers 
Original-Maintainer: Debian lighttpd maintainers 
Architecture: amd64
Version: 1.4.28-2ubuntu4
Provides: httpd, httpd-cgi
Depends: libattr1 (>= 1:2.4.46-5), libbz2-1.0, libc6 (>= 2.4), libgamin0 | libfam0, libldap-2.4-2 (>= 2.4.7), libpcre3 (>= 8.10), libssl1.0.0 (>= 1.0.0), zlib1g (>= 1:1.1.4), lsb-base (>= 3.2-14), mime-support, libterm-readline-perl-perl
Recommends: spawn-fcgi
Suggests: openssl, rrdtool, apache2-utils, ufw
Conflicts: cherokee (

lsof command find out what is using port 80

Type the following command
# lsof -i :80 | grep LISTEN
Sample outputs:

apache2   1607     root    3u  IPv4   6472      0t0  TCP *:www (LISTEN)
apache2   1616 www-data    3u  IPv4   6472      0t0  TCP *:www (LISTEN)
apache2   1617 www-data    3u  IPv4   6472      0t0  TCP *:www (LISTEN)
See also

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 5 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf duf ncdu pydf
File Managementcat cp mkdir tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Modern utilitiesbat exa
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg glances gtop jobs killall kill pidof pstree pwdx time vtop
Searchingag grep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
5 comments… add one
  • Jalal Hajigholamali Aug 10, 2013 @ 1:42


    Thanks a lot,

    i forwarded this article to my students

  • Meow Aug 10, 2013 @ 11:06

    you should introduce ss instead of netstat, because the later one is deprecated.

    • 🐧 nixCraft Aug 12, 2013 @ 11:23

      See “See also” section at the bottom of the faq.

  • Erik Aug 15, 2013 @ 14:54

    I find ss to be MUCH faster then netstat. It lacks all the detailed output for netstat is perfect for the question asked. Also ss is great for scripts because of its speed. Especially for boxes that have hundreds to thousands of connections.
    ss -anl4

    emathis@emathis-lappy:~$ time ss -anl &> /dev/null ; time netstat -anl &>/dev/null
    real 0m0.009s
    user 0m0.000s
    sys 0m0.000s

    real 0m0.024s
    user 0m0.008s
    sys 0m0.012s

  • aref ghobadi Aug 16, 2015 @ 10:19

    thank you

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum