Find Which Process Owns an Unexpected Open Port on Linux

An open port scan tells you that something answered; it does not tell you whether the listener is expected or safe to stop. Identify the local process, configuration and intended network path before taking action.

Find listeners on the server

sudo ss -lntup
sudo lsof -nP -iTCP -sTCP:LISTEN

ss reports listening TCP and UDP sockets. lsof can associate a TCP listener with a process when installed and permissions permit. Compare the local address: loopback-only listeners differ from wildcard listeners bound to external interfaces.

Map the process to its owner

Use the PID and executable to inspect the systemd unit, container or application configuration that started it. A process may be managed by a container runtime or supervisor, so killing the PID can cause an automatic restart or interrupt a dependent service.

Compare the listener with the firewall, cloud security group and load-balancer configuration. A local socket is not necessarily reachable from the public internet; verify from the intended client network using an approved test.

Decide whether to keep, restrict or remove it

Ask the application owner which clients need the service. Restrict its bind address or network rules when appropriate, and update the service's managed configuration. If it is genuinely abandoned, schedule removal and confirm no dependency uses it.

After changing the service, repeat the local listener check and an external reachability test. Keep the service owner and change record so the same port does not reappear without explanation.