Which Ports Are In Use (Netstat)

There’s a few parameters to netstat that are useful for this :

  • -l or --listening shows only the sockets currently listening for incoming connection.
  • -a or --all shows all sockets currently in use.
  • -t or --tcp shows the tcp sockets.
  • -u or --udp shows the udp sockets.
  • -n or --numeric shows the hosts and ports as numbers, instead of resolving in dns and looking in /etc/services.

To know which port numbers are currently in use, use one of these:

netstat -atn           # For tcp
netstat -aun           # For udp
netstat -atun          # For both

In the output all ports listed are in use either listening for incoming connection or connected to a peer (or connecting/disconnecting) all others are closed. TCP and UDP ports are 16 bits wide (they go from 1-65535)

You can also use this command:

netstat -tulnp | grep <port no>

If it shows some process its used. Its closed if there is no output.

Another alternative command line easy to use to find out which process is using a port:

lsof -n -i4TCP:$PORT | grep LISTEN

I added the next function in my .bash_profile,

function pslisten {
    echo `lsof -n -i4TCP:$1 | grep LISTEN`
}

and now run “pslisten 5060” to see who is grabing my SIP port.