Cheatsheet: Find Listening Ports

On Linux: netstat -tulnp | grep <port_number> shows the protocol, local address:port, state, and PID/program name. On macOS, netstat doesn't support -p for the owning process, so use netstat -an | grep <port_number> to confirm the port is listening, then cross-reference the PID with lsof -i :<port_number>.

macOS's BSD-derived netstat never implemented the Linux -p/--program flag, so it can list listening sockets (netstat -an) but not the owning process. Use lsof -i :<port_number> or lsof -nP -iTCP -sTCP:LISTEN instead — these show the PID and command name directly on macOS.

ss (socket statistics) is the modern Linux replacement for netstat, reads directly from the kernel's netlink interface instead of parsing /proc, and is significantly faster on systems with many connections. The command-line flags are similar by design: ss -tulnp is the ss equivalent of netstat -tulnp.

lsof -t -i :<port_number> prints only the PID(s) using that port (the -t/terse flag), which is convenient for scripting, e.g. kill $(lsof -t -i :3000) to kill whatever is bound to port 3000.

With ss: ss -tlnp (the -l flag restricts output to listening sockets only). With lsof: lsof -nP -iTCP -sTCP:LISTEN filters to TCP sockets in the LISTEN state. Plain netstat -tulnp already implies listening-only for UDP but for TCP you may want to add grep LISTEN.