How to Find What Process is Using a Port

Best way: portrm (all platforms)

portrm gives you more than just the PID. It identifies the service name, memory usage, uptime, and safety classification:

$ ptrm 3000

  Port 3000
  Process:  node (PID 48291)
  Service:  Next.js dev server (95% confidence)
  Memory:   69.4 MB
  Uptime:   2h 15m
  Safety:   SAFE - development server

To see all listening ports at once:

$ ptrm scan

  PORT   PROCESS         SERVICE      MEMORY    UPTIME   SAFETY
  3000   node            Next.js      69.4 MB   2h 15m   SAFE
  5432   postgres        PostgreSQL   38.2 MB   5d 2h    WARNING
  6379   redis-server    Redis        12.6 MB   5d 2h    WARNING
  8080   node            Express.js   54.8 MB   45m      SAFE

macOS: Using lsof

lsof (list open files) is the standard macOS tool for finding port usage:

# Find process on a specific port
$ lsof -i :3000
COMMAND   PID  USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
node    48291  dev    23u  IPv6  0x...  0t0      TCP  *:hbci (LISTEN)

# Show only the PID
$ lsof -ti :3000
48291

# Show all listening ports
$ lsof -i -P -n | grep LISTEN

Understanding lsof output

Linux: Using ss

ss (socket statistics) is the modern replacement for netstat on Linux:

# Find process on port 3000
$ ss -tlnp | grep :3000
LISTEN  0  511  *:3000  *:*  users:(("node",pid=48291,fd=23))

# Alternative: using lsof (if installed)
$ lsof -i :3000

# Using fuser
$ fuser 3000/tcp
3000/tcp:  48291

ss flags explained

Windows: Using netstat

REM Find process on port 3000
> netstat -ano | findstr :3000
  TCP    0.0.0.0:3000    0.0.0.0:0    LISTENING    15832

REM Get the process name from PID
> tasklist | findstr 15832
node.exe    15832    Console    1    65,432 K

PowerShell method

# Single command to get port, PID, and process name
PS> Get-NetTCPConnection -LocalPort 3000 |
    Select-Object LocalPort, OwningProcess,
    @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}

Check multiple ports at once

# portrm - check specific ports
$ ptrm 3000 5432 8080 6379

# lsof - multiple ports
$ lsof -i :3000 -i :5432 -i :8080

# ss - grep for several ports
$ ss -tlnp | grep -E ':(3000|5432|8080)'

Why portrm shows more than lsof