What’s Running on Port 8000? (And how to stop it)

Finding out what’s running on port 8000

$ lsof -i TCP:8000 | grep LISTEN

The lsof command lists “open files” hence the name and the -i flag shows network connections. We pass TCP:8000 and then grep for records that have LISTEN on them (ie processes listening/ready on 8000)

Tais-MBP:~ tailu$ lsof -i TCP:8000 | grep LISTEN
node      97749 tailu   44u  IPv4 0x87d9634a5bd15ff9      0t0  TCP localhost:irdmi (LISTEN)

We are most interested in the number in second column, the PID, because we can use that to kill the process.

$ kill -9 97749

As a somewhat clunky single-banger you can even run this (swap out $PORTNUM with your target port):

kill -9 $(lsof -i TCP:$PORTNUM | grep LISTEN | awk '{print $2}')

How to Use the Linux lsof Command

To see the processes that have opened kern.log file

sudo lsof /var/log/kern.log

To see all the files that are open in the /var/log/ directory

sudo lsof +D /var/log/

To see the files that have been opened by a particular process, use the -c (command) option.

sudo lsof -c ssh -c init

To see the files that have been opened by a user

sudo lsof -u mary

To exclude the files that have been opened by a user, use the ^ operator

sudo lsof +D /home -u ^mary

List FIles Opened by a Process

sudo lsof - p 4610

Listing Process IDs That Have Opened a FIle

sudo lsof -t /usr/share/mime/mime.cache