to find out which user and which process is making connections on a port

lsof -i tcp:80 -P -R

This command shows us all running processes that are using port 80 for any kind of communication.

  • The -i parameter specifies we want to list the processes, by identifying them with IPv4 or IPv6.
  • The tcp:80 part means we only want to show TCP connections (and ignore UDP for the time being) using port 80.
  • Using -P we specify we want to see the port numbers (80, 21, …) instead of the names (HTTP, FTP) which are shown by default. Much like the -n parameter with netstat.
  • With -R we also show the Parent Process ID, to see who initiated this process.