How to check port occupancy (windows, linux, mac)

How to check port occupancy, each platform

1. Background

How to check port occupancy? There are many online, but most of them throw out commands directly without any explanation on how to view the output of the command.

The so-called "check port occupation" means to check whether a certain port is occupied by a certain program, and if so, by which process. PS: Processes are identified by process IDs.

2. Command Overview

Applicable platforms	Order	effect	Replenish
Linux	netstat -tunlp|grep 8080	View the process ID occupying port 8080	It cannot be used in MacOS. Look at the fourth column (local address) and see the PID corresponding to the row that exactly matches the port number. This command itself finds out that LISTEN is listening! (Linux displays it as LISTEN, Windows displays it as LISTENING, which means the same thing)
Windows	netstat -ano|findstr 8080	Check the process ID occupied by port 8080	You can also use findStr for findstr, and you can also use double quotes "8080" for 8080. Look at the second column (that is, the local address) and see the PID corresponding to the row that exactly matches the port number and the status is LISTENING.
MacOS/Linux	lsof -i:8080	Check the process ID occupied by port 8080	It is used in MacOS and can be used in Linux, but Linux may not have this command by default and you have to install it yourself. If you encounter problems, you can try adding sudo in front: sudo lsof -i:8080This command exactly matches port 8080 and will not display the occupation of 18080.

Note that the LISTEN state in Linux is the LISTENING state in Windows. Different words are used for the same meaning.

3. Detailed explanation of the output results of the command

3.1、Windows：netstat -ano|findstr 8080

Just replace the port number with the port number you want to check.

3.1.1. The returned result is similar to

So many columns, the meaning from left to right is: protocol, local address, external address, status, process ID

Can't remember to use netstat -anothe output header (note that the header and the value are slightly misaligned)

netstat -ano|findstr 8080The meaning of findstr, or grep in Linux, is to filter out each line with the 8080 string from the previous output result, that is, the result line by line, and reassemble the result. The filtering rule is fuzzy matching before and after, that is, %yourKeyword%. No matter which column in a row contains the 8080 string, it will be filtered out. For example, local addresses or external addresses may be matched because they contain 8080. Obviously the header will be filtered out because it does not contain 8080. This is why the header is not displayed after filtering. You netstat -ano|findstr 本地can filter out the header by using .

3.1.2 Interpretation of command output results officially begins

If nothing is output, there is no process occupying this port.

If occupied, at least the following will be entered:

Sometimes it's a little more complicated and it will output

How to check it? There are so many 8080s and the process IDs are different.

• First, look at the second column. Look at the port 8080 in the second column.
• Finally, look at the LISTENING status

After filtering, there will be 2 items left. One of them is IPv4 and the other is IPv6. They are both the same. It prompts that it is occupied by the 12636 process.

The writing method of IPv4: 0.0.0.0:8080, the writing method of IPv6: [::]:8080

Sometimes the LISTENING status cannot be found, but other things are found. At this time, there is actually no port occupied.

This situation occurs because, for example, 8080 itself is started and will leave traces after being accessed. Then after the 8080 process is killed, the LISTENING status will disappear immediately, but other statuses will be cached for a period of time. After the actual test for a period of time (I didn’t count how long), I checked again and found nothing.

3.1.3 Explanation of other possible doubts

• Why are there 2 lines?

  One line is for IPv4 and the other is for IPv6. Although there are two lines, the process ID is actually the same, there is no inconsistency. In fact, I don’t know the details very well. If you know more details, you can leave a message.

• Why do we need to see the second column (local address), why do we need to see the second column and not the third column (external address), and why do we need to see the LISETNING status?

  • First of all, the basic knowledge is that if both parties want to connect, the processes of both parties must have addresses (IP and port numbers) to connect, so there are two addresses.

    For example, if you visit a website in a browser, it seems that your local machine does not need IP and port. In fact, if you open the developer tools of the browser, you can see that every request made has your local IP address.

  • Generally speaking, if you want to check whether a certain port is occupied, then this port must have been occupied all the time before you need to check it, so you need to check the LISTENING status, because LISTENING means that it is permanently occupied and is listening.

  • You want to check the local address instead of the remote address because the local address is the port that has been occupied by a certain service since it is started. The remote address is the IP and port of the local machine that needs to be connected remotely. You definitely don’t need to worry about the remote address. After all, the remote address needs to connect to the server. Generally, temporary port numbers are used and are recycled after use.

    When we use jmeter for stress testing, we actually have basic knowledge, that is, you need to simulate more than 60,000 users accessing an interface at the same time, and a single machine is not possible. Because, for example, if your jmeter is installed on machine A, the operating system has a maximum of 65536 port numbers. If you want to simulate such a user on machine A at the same time , you have to start so many threads at the same time. One thread represents one user, so each thread will occupy one The port number communicates with the interface on the server being stressed. A maximum of 65536 port numbers on a machine are used simultaneously. Therefore, the number of simultaneous stress tests on a machine is naturally limited by the maximum number of ports.

  • 0.0.0.0:8080in the second column 0.0.0.0refers to the remote port number that is not restricted

    Anyone who is familiar with Redis configuration knows that there is a bind configuration. 0.0.0.0 means that anyone can connect, and 127.0.0.1 means that only local connections can be made. This way you can limit the IP addresses of remote connections, which is more secure. Same meaning here
    

3.2. Linux (some principles are the same as Windows. It is recommended that if you are unclear, you can read Windows)

Use netstat -tunlp|grep 8080this command to remember tunlp, tun+lp, and wife. . . The order of the final output columns has nothing to do with these letters. For example, netstat -tunpl|grep 8080the output does not change the position of the columns.

Since lthe parameters of this command only detect the LISTEN status (that is, listening), there is no need to manually filter the listening status. You only need to look at the address in column 4, which is the local address. As long as this column can completely match your Just use the port number you want to check, and the PID in the matching row is what you are looking for.

Similarly, if you don’t know the table header, you can ask the command to remove the grep part and check netstat -tunlpit. You can find that the order is: Proto, Recv-Q, Send-Q, Local Address, Foreign Address, State, PID/Program name

(TODO: additional screenshots)

3.3、MacOS

3.3.1. Uselsof -i:8080

You can check the programs occupying port 8080 and add sudo if necessary, such as sudo lsof -i:8080.

Interpretation of results

• The output result is as shown below, there are multiple, but it depends on the LISTEN status.

• The port parameter of this command is an exact match, that is, it matches 8080 exactly and will not match the occupation of port 18080. I have done experiments and verified it.

As shown in the figure below, if a port is not occupied, there will be nothing

As shown in the figure below, if there is an output result, but there is no LISTEN status (see the arrow brackets), there is no program occupying it.

(Why is there no LISTEN status? This may be due to the previous cache. If the program on port 8080 has just been accessed, and then the program on port 8080 is killed immediately, there will be no LISTEN status immediately, but because the program that has accessed port 8080 There will be a bit of cache, and if you check again after a while, you will find that the following information is gone)

As shown in the figure below, if there is one item in the LISTEN state, you can find the occupying program by checking the PID.

How can I prove that lsof -i:8080the 8080 I found above is not the 18080? I started two web programs at 8080 and 18080 at the same time. lsof -i:8080The results I can see are not mixed with the results of port 18080, and I lsof -i:18080can correctly find the real occupying program.

3.3.2 Use the netstat command (clearly this command does not seem to work)

MacOS can also use netstatthe command, but the parameters are not the same as those in Linux. This is because macOS uses BSD-based network tools, so netstatthe parameters and output format of the command may be slightly different from those in Linux.

The command used is netstat -an|grep 8080 , but unfortunately this command cannot output the PID column. netstat --helpAfter checking the help document, it seems that there are no parameters to support, so there is no solution for the time being. Netstat cannot be used to check port occupation in MacOS . If you know anything, you can add it in the comment section.

4. Supplement:

Regarding the usage of netstat, you can use it in Linux/Windows to netstat --helplist the meanings of the letters of the following options. Windows outputs Chinese by default. You can also chcp 437command first, switch to English, and then check the help of the command.

• Windows Chinese and English versions
  

The Chinese version is as follows

• Linux

(TODO to be added)

• MacOS

  • lsof command
    

  • netstat command

    The following command prompts the usage method, and it seems to prompt illegal option. Maybe netstat --helpit is not a way to view the command for macOS, but the correct Usage is only prompted because the wrong command is used?

    In any case, the usage method is hinted. If you don’t want to go into too long, you can use to man nestatview the usage method of the command.