Linux: Find Out What Is Using TCP Port 80

To find out what process is using TCP port 80 on a Linux system, you can use the netstat command with the -tlnp flags. The -t flag specifies that you want to see TCP connections, the -l flag shows only listening sockets, the -n flag shows numerical addresses rather than hostnames, and the -p flag shows the PID and name of the process associated with each connection.

For example:

$ netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      4275/nginx -g daemon

This will show all the processes that are listening on TCP port 80, along with their PID and name. In this example, the process is an instance of nginx listening on port 80.

Alternatively, you can use the lsof command with the -i flag to list the open Internet sockets on the system, along with the process ID and name of the process that is using each socket. For example:

$ lsof -i :80
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
nginx   4275 nobody    6u  IPv4  44640      0t0  TCP *:http (LISTEN)

This will show the same information as the netstat command, but it may be easier to read in some cases.

Note that these commands will only show processes that are listening on port 80. If a process is connected to port 80 but not listening on it, it will not be shown in the output of these commands.