Dev Journal

Who is listening on that port

24 September 2026

When a service refuses to start with "address already in use", the first job is to find what holds the port. ss is installed almost everywhere and reads the kernel tables directly, so it stays fast on busy machines.

ss -tlnp

The flags mean TCP, listening only, numeric ports, and show the owning process. Without root you only see your own processes, so run it with sudo to get the full picture. Add -u for UDP sockets.

To look at live connections instead of listeners, filter by state and port:

ss -tn state established '( dport = :443 or sport = :443 )'

A quick summary of how many sockets exist in each state comes from a single command:

ss -s

A large number of sockets in TIME-WAIT is usually harmless. A growing number in CLOSE-WAIT is not, because it means the local application never closed its side of the connection, and that is a bug to look for in the program rather than in the network.