Find the Process Using a Specific Port in Ubuntu

"Address already in use" is one of the most common errors when starting a dev server or a service — something else already has that port. Here's how to find exactly what, and deal with it.

The modern way: ss

sudo ss -tlnp | grep ':3000'

LISTEN 0 511 *:3000 *:* users:(("node",pid=48213,fd=20))

ss (socket statistics) is the modern replacement for the older netstat, and it's what's actually installed by default on current Ubuntu. The flags: -t (TCP), -l (listening sockets only), -n (show ports as numbers, not service names), -p (show the owning process — needs sudo).

The classic way: lsof

sudo lsof -i :3000

COMMAND   PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    48213 sheetal   20u  IPv4 123456      0t0  TCP *:3000 (LISTEN)

lsof ("list open files" — sockets count as files in Unix) is the one most tutorials mention, and it's still perfectly good; it just isn't installed by default on every minimal Ubuntu image the way ss is.

Killing it in one line: fuser

sudo fuser -k 3000/tcp

This finds whatever's bound to port 3000 and kills it immediately — useful for a quick "just free up this port," but skip it when you actually want to know what was running there first (a stray process left over from a crashed dev server is very different from a production service you didn't mean to touch).

The full workflow

sudo ss -tlnp | grep ':3000'   # 1. find the PID
kill 48213                     # 2. try a graceful shutdown first
kill -9 48213                  # 3. only if it ignores the plain kill

Always try a plain kill before kill -9. A plain kill sends SIGTERM, which well-behaved processes catch to shut down cleanly (closing database connections, flushing logs); -9 sends SIGKILL, which the OS enforces immediately with no chance for cleanup — reach for it only when the process is genuinely stuck.