Kill a process running on a specific port?

Killing a process running on a specific port is a common system administration task in Linux. When a service is running on a port you need to free up, or when a process becomes unresponsive, you need to identify and terminate it. This article covers various methods to find processes by port and terminate them safely.

Identifying Processes Using Their Ports

Before killing a process, you must first identify which process is using a specific port. The netstat command shows active network connections and listening ports:

$ netstat -lntp | grep :80
tcp6 0 0 :::80 :::* LISTEN 8072/httpd
tcp4 0 0 ::ffff:127.0.0.1:80 :::::80 8069/httpd
tcp6 0 0 127.0.0.5:53 :::* LISTEN 903/named
udp6 0 0 :::22 :::* LISTEN 4963/sshd

The -l flag shows listening sockets, -n displays numerical addresses instead of resolving hosts, -t shows TCP connections, and -p displays the process ID and name.

Preparing Test Examples

Let's create some test processes using socat to demonstrate the different methods:

$ socat sctp-listen:9999,bind=127.0.0.1 stdout &
[1] 6424

$ socat tcp-listen:9999,bind=127.0.0.1 stdout &
[2] 6431

$ socat udp-listen:9999,bind=127.0.0.1 stdout &
[3] 6438

These commands create three processes listening on port 9999 using SCTP, TCP, and UDP protocols respectively.

Using the fuser Command

The fuser command is the most direct way to kill processes using a specific port. The -k parameter kills the process:

$ fuser -k 9999/tcp
9999/tcp: 6431

The notation 9999/tcp specifies the port and protocol. You can also use 9999/udp for UDP connections. Note that fuser only works with TCP and UDP protocols it cannot handle SCTP or other protocols.

Using the kill Command with Process Discovery

For more control and support of additional protocols, you can combine the kill command with tools that identify process IDs (PIDs).

lsof Command

The lsof (list open files) command shows information about files opened by processes, including network sockets:

$ lsof -i udp:9999 | awk '/9999/{print $2}' | xargs kill

The -i parameter filters processes using the syntax [protocol][:port]. The awk command extracts the PID (second column), and xargs kill terminates the process.

ss and netstat Commands

For SCTP and other protocols, use ss (socket statistics) or netstat with pattern matching:

$ ss -Slp | grep -Po ':9999\s.*pid=\K\d+(?=,)' | xargs kill

The -S flag shows SCTP connections, -l shows listening sockets, and -p shows processes. The regex extracts the PID from the output format.

Alternatively, using netstat:

$ netstat -Slp | grep -Po ':9999\s.*LISTEN.*?\K\d+(?=/)' | xargs kill

This searches for the PID between "LISTEN" and the "/" character in the output.

Method Comparison

Conclusion

Several methods exist for killing processes running on specific ports. The fuser command provides the simplest approach for TCP/UDP processes, while combining lsof, ss, or netstat with kill offers more flexibility and protocol support. Choose the method that best fits your specific requirements and available tools.