如何查找绑定特定IP:Port的进程及对应PID

Got it, let's tackle this problem—finding exactly which process is bound to a specific IP:Port combo when you've got multiple IPs and overlapping ports on your server. Here are the most reliable methods for different operating systems:

Using ss (modern replacement for netstat) #

• The ss tool is more efficient than netstat and delivers precise results. Run this command, replacing 192.168.1.100 and 8080 with your target IP and port:

  ss -tulpn | grep "192.168.1.100:8080"
  

  • Flag breakdown:
    • -t: Show TCP sockets
    • -u: Show UDP sockets (remove this flag if you only care about TCP)
    • -l: Focus on listening sockets
    • -p: Display the process associated with each socket
    • -n: Skip hostname/port resolution (faster, avoids unnecessary DNS lookups)
  • The output will directly list the PID and process name alongside your target IP:Port pair, so you can instantly identify the correct process.

Using netstat (if ss isn't available) #

• If your system still has netstat installed, use this command instead:

  netstat -tulpn | grep "192.168.1.100:8080"
  

  • The flags work the same way as above, and this will filter strictly for your specific IP:Port combination—so you won't get clutter from other IPs using the same port.

Using netstat with Command Prompt/PowerShell #

• Open Command Prompt or PowerShell as an administrator, then run:

  netstat -ano | findstr "192.168.1.100:8080"
  

  • -a: Show all connections and listening ports
  • -n: Use numerical addresses/ports (no name resolution)
  • -o: Include the PID tied to each connection
  • To get the process name from the PID you found, run this (replace 1234 with your target PID):

    tasklist /fi "PID eq 1234"
    

PowerShell-native approach with Get-NetTCPConnection #

• For a more streamlined PowerShell workflow, use this command:

  Get-NetTCPConnection -LocalAddress "192.168.1.100" -LocalPort 8080 | Select-Object LocalAddress, LocalPort, OwningProcess
  

  • This directly filters for your target IP and port, returning the PID as OwningProcess. To get the process name from the PID:

    Get-Process -Id 1234
    

• Tools like lsof work on Linux, macOS, and even Windows via WSL. Run this to target your IP:Port:

  lsof -i "TCP@192.168.1.100:8080"
  

  • Swap TCP for UDP if you need to check UDP connections. The output will show the PID in the PID column and process name in the COMMAND column.

内容的提问来源于stack exchange，提问作者Farhan Habib