How to Find What Port Number a Program Is Using

Finding a port number on Windows, Mac, or Linux

A port number is a four- or five-digit number that identifies which door a program is using to send data in or out of your computer. When you set up a home network, you sometimes need to know which port a program has claimed so you can block it, forward it to another device, or check whether something unexpected is running. The method depends on your operating system.

On Windows, the fastest way is through Command Prompt. On Mac and Linux, you use the Terminal. Both show you a list of active ports and which program owns each one. You do not need administrator permission to look, though some ports are hidden unless you run the command as administrator.

Key Takeaways

Port numbers range from 1 to 65535, and each program using your network connection claims one or more of them.
On Windows, type netstat -ano in Command Prompt to see all active ports and the process ID of the program using each one.
On Mac or Linux, type netstat -tuln or ss -tuln in Terminal to see listening ports and their associated programs.
If you see a port number you do not recognize, you can search the process ID or program name online to learn what it does.
Ports below 1024 are reserved for system services; programs you install usually claim higher numbers.

Checking ports on Windows using Command Prompt

Open Command Prompt by pressing the Windows key, typing cmd, and pressing Enter. Type the command netstat -ano and press Enter. You will see a table with five columns: Proto (the protocol, usually TCP or UDP), Local Address (your computer's address and port), Foreign Address (where the connection goes), State (whether it is listening or established), and PID (the process ID number).

Find the port number you are looking for in the Local Address column. It appears after a colon — for example, 127.0.0.1:8080 means port 8080. The PID column on the right tells you which program owns it. Write down that number, then open Task Manager by pressing Ctrl+Shift+Esc. Click the Processes tab, then click the Details tab. Look for the process ID in the PID column. When you find it, the Image Name column shows you the program name.

If you want to see only listening ports (ones that are actively waiting for connections rather than ones that are already connected), type netstat -ano | findstr LISTENING instead. This filters the list and makes it easier to scan.

Checking ports on Mac using Terminal

Open Terminal by pressing Command+Space, typing terminal, and pressing Enter. Type netstat -tuln and press Enter. You will see a table showing Proto, Recv-Q, Send-Q, Local Address, Foreign Address, and State. The Local Address column shows your computer's address and port number separated by a period — for example, 127.0.0.1.8080 means port 8080.

This command shows listening ports but not which program owns them. To see the program name, type lsof -i -P -n instead. This shows a different format: the COMMAND column on the left lists the program name, and the NAME column shows the address and port. Look for the port number you are searching for and read across to see what program claimed it.

If you want to see only a specific port, you can type lsof -i :8080 (replacing 8080 with your port number) to show only that port and what is using it.

Checking ports on Linux using Terminal

Open Terminal and type ss -tuln (this is the newer command; older systems may need netstat -tuln). You will see a table with State, Recv-Q, Send-Q, Local Address, Peer Address, and Process columns. The Local Address column shows the port number after a colon — for example, 127.0.0.1:8080 means port 8080. The Process column on the right shows the program name and process ID.

If the Process column is empty or shows only a dash, you may need to run the command with administrator privileges. Type sudo ss -tuln and enter your password. This shows all ports, including system ones you may not recognize.

To see only a specific port, type sudo ss -tuln | grep :8080 (replacing 8080 with your port number).

Understanding what you see in the results

When you look at port listings, you will see two types of connections: ones that say LISTENING (or LISTEN) and ones that say ESTABLISHED. A listening port is waiting for incoming connections. An established port is actively connected to another computer. For network security, you care most about listening ports, because those are the doors open to the outside world.

You will also see addresses like 127.0.0.1 (called localhost) and 0.0.0.0. Localhost means the program is only listening on your computer and cannot be reached from other devices on your network. An address of 0.0.0.0 means the program is listening on all network interfaces and can be reached from anywhere your network reaches. This matters when you are deciding whether to block or forward a port.

Ports below 1024 are reserved for system services like web servers, email, and DNS. Ports 1024 and above are available for any program. If you see a high port number (above 5000) that you do not recognize, search the process name online — it is usually a legitimate background service, but it is worth checking.

Finding a port when you know the program name

If you already know which program you want to check, you can search for it directly instead of scanning the whole list. On Windows, open Command Prompt and type netstat -ano | findstr program_name (replacing program_name with the actual name, like chrome.exe or python.exe). On Mac, type lsof -i -P -n | grep program_name. On Linux, type ss -tuln | grep program_name.

This shows only the ports that program is using, which is faster than reading through dozens of entries. If the program is not running, the command will return no results — that is normal.

What to do if you find an unfamiliar port

If you see a port being used by a program you do not recognize, do not panic. Most background services have names that are not obvious. Take the program name or process ID and search it online — include the word "port" in your search. You will usually find documentation or forum posts explaining what it does.

Common legitimate programs that use high port numbers include Docker, database servers, development tools, and media servers. If you find something that concerns you, you can disable it through your system settings or uninstall it if you do not need it. You do not need to close it from the port listing itself — closing the program closes the port automatically.

Frequently Asked Questions

Why do I see the same port listed twice with different protocols?

A port can be used by both TCP and UDP at the same time — they are different ways of sending data. TCP is connection-based (like a phone call), and UDP is connectionless (like sending a postcard). Some programs use both. You can block or forward one without affecting the other.

Can I change what port a program uses?

Many programs let you choose their port in their settings or configuration file. Some do not. Check the program's documentation or settings menu. If you change a port, you may need to restart the program for the change to take effect, and you will need to update any firewall rules or port forwarding you set up for the old port.

What if a port shows as LISTENING but I did not start that program?

It is probably a background service that starts automatically when your computer boots. Search the program name online to confirm what it does. If you do not need it, you can disable it through your system settings (Windows Services on Windows, LaunchAgents on Mac, or systemctl on Linux), but be careful not to disable system services you actually need.

Do I need to check ports to set up my home network securely?

Not always. You only need to check ports if you are setting up port forwarding, configuring a firewall, or troubleshooting a connection problem. If you are just connecting devices to your router normally, port numbers are handled automatically in the background.

Why does the same port sometimes show different programs?

A port can only be used by one program at a time. If you check the same port at different times and see different programs, one program closed and another started using that port. This is normal. If you see the same port claimed by two programs at the same time, one of them will fail to start or will use a different port instead.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.