lsof -i

~12 min · lsof, ports, process, eaddrinuse

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

The right answer to "port already in use"

lsof -i tells you which process is using which network ports — including the program name, PID, and user. On macOS this is the go-to tool because netstat doesn't show process info. On Linux, ss -tulnp is roughly equivalent.

The one-liner you'll use forever

When a dev server fails with "EADDRINUSE :::3000", the cycle is:

lsof -i :3000 — what's holding the port?
Note the PID.
kill PID (or kill -9 PID if it ignores the polite request).

Or do it in one shot: lsof -ti :3000 | xargs kill -9. -t outputs just PIDs, suitable for piping into kill.

Code

lsof -i recipes·bash

# What's running on port 8000?
lsof -i :8000

# All network connections, numeric ports (faster, less DNS)
lsof -i -P -n

# Just listeners
lsof -i -P -n | grep LISTEN

# The one-liner — kill whatever's on :3000
lsof -ti :3000 | xargs kill -9

# Connections of a specific process
lsof -i -P -n | grep node

# All connections to a specific remote host
lsof -i @192.168.1.100

Walk-through of an EADDRINUSE·bash

# Your dev server fails:
#   Error: listen EADDRINUSE: address already in use :::3000

# Find the culprit
lsof -i :3000
# COMMAND   PID  USER   FD   TYPE  DEVICE  NAME
# node    12345  you_username 22u  IPv6  0x...   *:3000 (LISTEN)

# Kill it
kill 12345

# Or if it's stuck:
kill -9 12345

# Verify
lsof -i :3000   # should be empty

External links

lsof manual

Exercise

Start a quick server: python3 -m http.server 8080 &. Then run lsof -i :8080 and identify the PID. Use the one-liner lsof -ti :8080 | xargs kill -9 to terminate it. Verify with lsof -i :8080 (should be empty). This cycle is what you'll do hundreds of times a year.