Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to find some processes which are running on a specified port for example 80

I ran

fuser 80/tcp

and got nothing

and then

netstat -tulpn|grep "80\|PID"

and got

Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 :::80                       :::*                        LISTEN      -  

the PID is -

so what does - mean? thanks!

share|improve this question
Do you run these commands as root? – mpy Apr 24 '13 at 14:33
no, ah, I ran it now as root, it shows results, thanks – misteryes Apr 24 '13 at 14:38
@mpy Please post this as an answer (maybe extend it and explain why you need to be root etc.) – slhck Apr 24 '13 at 19:30
@slhck: You gave quite a tough nut to crack why you need to be root... ;) – mpy Apr 24 '13 at 21:14
@mpy Haha, well that's a great answer for sure. I just thought that "You have to be root" wouldn't pass the quality filter :) – slhck Apr 24 '13 at 21:23

The short answer is: You need to be root in order to see all bindings.

A little bit longer:

The manpage of netstat gives a hint that is not necessary in all cases:

PID/Program name Slash-separated pair of the process id (PID) and process name of the process that owns the socket. --program causes this column to be included. You will also need superuser privileges to see this information on sockets you don't own.

So, as a normal user you only see which process listens to a port, if you own it:

$ netcat -l -p 1234 &
$ netstat -tulpn
tcp        0      0  *               LISTEN      8044/netcat     
tcp        0      0    *               LISTEN      -    

You see "your" netcat process, but not who is listening to e.g. port 22.

I have a feeling, that the reason for that is, that you can't acces /proc/[PID]/fd for not-owned processes. There you find the file descriptors process [PID] has currently opened and in Un*x (nearly) everything is a file... and so are sockets.

In my example sshd, pid 3934, listens to port 22 (surprise-surprise):

$ whoami
$ ls -l /proc/3934/fd
/bin/ls: cannot open directory /proc/3934/fd: Permission denied
$ sudo ls -l /proc/3934/fd
total 0
lrwx------ 1 root root 64 Apr 24 16:33 0 -> /dev/null
lrwx------ 1 root root 64 Apr 24 16:33 1 -> /dev/null
lrwx------ 1 root root 64 Apr 24 16:33 2 -> /dev/null
lrwx------ 1 root root 64 Apr 24 16:33 3 -> socket:[10481]
lrwx------ 1 root root 64 Apr 24 16:33 4 -> socket:[10483]

(The second socket is bond to the IPv6 adress which I omitted in my netstat output.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.