How to Find Which Process Is Using a Port on Windows, macOS, and Linux

A “port already in use” message usually means another process is listening on that port. Find the process ID, or PID, attached to the port, then use that number to identify the application.

Quick answer

Replace 8080 with the port you need to inspect.

Once you’ve got the PID, check the process name before stopping anything. Don’t terminate an unfamiliar system process just to free a port.

Find the process on Windows

Use PowerShell

Open PowerShell as an administrator, then run:

Get-NetTCPConnection -LocalPort 8080 |
    Select-Object LocalAddress, LocalPort, State, OwningProcess

The number under OwningProcess is the PID. Feed that value into Get-Process to see the application’s name:

$connection = Get-NetTCPConnection -LocalPort 8080
Get-Process -Id $connection.OwningProcess

More than one connection may be using the local port. In that case, return the unique process IDs:

Get-NetTCPConnection -LocalPort 8080 |
    Select-Object -ExpandProperty OwningProcess -Unique |
    ForEach-Object { Get-Process -Id $_ }

Checking UDP instead? Use Get-NetUDPEndpoint:

Get-NetUDPEndpoint -LocalPort 53 |
    Select-Object LocalAddress, LocalPort, OwningProcess

Use Command Prompt

Open Command Prompt and enter this command:

netstat -ano | findstr :8080

A typical result looks something like this:

TCP    0.0.0.0:8080    0.0.0.0:0    LISTENING    6420

That last number, 6420 here, is the PID. Look up the process attached to it:

tasklist /FI "PID eq 6420"

You can check it in Task Manager too. Open Details, then find the same number in the PID column.

Find the process on macOS

macOS comes with lsof, a tool that shows open network sockets and the processes that own them. In Terminal, run:

lsof -nP -iTCP:8080 -sTCP:LISTEN

Those options skip hostname and service-name lookups. That keeps the ports numeric and usually makes the command faster. The output may look like this:

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node     3812 alex   21u  IPv6  ...       0t0  TCP *:8080 (LISTEN)

Here, a Node.js process with PID 3812 is listening on port 8080.

For UDP, use this instead:

lsof -nP -iUDP:8080

No output? Try the command again with sudo. A process owned by another user may otherwise stay hidden.

Find the process on Linux

Check with ss

Most current Linux distributions include ss, which is generally the preferred tool for inspecting sockets:

sudo ss -ltnp 'sport = :8080'

• -l shows listening sockets.
• -t limits the output to TCP.
• -n keeps ports and addresses numeric.
• -p displays process information.

For a listening UDP port, swap -t for -u:

sudo ss -lunp 'sport = :53'

Try lsof instead

If lsof is installed, Linux accepts the same syntax used on macOS:

sudo lsof -nP -iTCP:8080 -sTCP:LISTEN

On Debian or Ubuntu, install it with:

sudo apt update && sudo apt install lsof

Fedora uses this command:

sudo dnf install lsof

Stop the process without causing trouble

Confirm what the process does before you stop it. A database, security tool, remote-access service, or operating system component may be supporting other applications, and shutting it down can interrupt them.

Windows

Stop-Process -Id 6420

If the application won’t close normally, force it only when you have to:

Stop-Process -Id 6420 -Force

In Command Prompt, run:

taskkill /PID 6420

macOS and Linux

Start with the standard termination signal:

kill 3812

Give the application a few seconds to shut down. Use kill -9 only as a last resort, since it doesn’t let the process perform its normal cleanup:

kill -9 3812

Why a port may already be in use

• An earlier instance of the application is still running in the background.
• A development server restarted without releasing its listener.
• Two applications are set to use the same port.
• A Docker container published that port on the host.
• A Windows service or Linux systemd service restarted automatically.
• The program is using IPv6, but you checked only an IPv4 address.

If Docker owns the port, find the container with:

docker ps --filter publish=8080

Then stop the right container or change its host-side port mapping.

Check that the port is free

After you’ve stopped or reconfigured the application, run the inspection command again. If no listening result appears, the port is generally available.

You can also check whether the machine still accepts a TCP connection. On Windows, use:

Test-NetConnection localhost -Port 8080

On macOS or Linux:

nc -vz localhost 8080

A failed connection is expected if nothing is listening. But if the process comes straight back, an automatically restarting service is probably involved. Deal with that service rather than repeatedly killing its PID.

A few safer habits

• Check the process name, executable path, and owner before stopping it.
• For managed services, use Services, systemd, Docker, or the service’s own control tool.
• If both services are needed, change the configured port for one application.
• Don’t force-kill database processes or applications that are writing to files.
• If process details are hidden, run the inspection command with administrator or root privileges.