To kill a Linux process you need its ID or its name. If all you know is the port it’s using, can you still kill it? Yes, in several different ways.

Killing Processes

Occasionally aLinux processcan become unresponsive. It may stop operating correctly, or it might continue to work but ignore requests for it to shut down, or start gobbling memory,CPU, or network bandwidth.

Related:How to Kill Processes From the Linux Terminal

Whatever your motives, there are ways to kill a process from the Linux command line. The classic method is to use thekill command with the process IDof the process you want to terminate. Thekillcommand has some close relatives. The

command will kill a process by name, and

Creating listening UDP and SCTP socket connections with socat

will kill all processes it can find that share part of a name.

If all you know about a process is it is using a port on your computer, there are still ways to identify and kill it. In networking terms, “port” can mean a physical connection into which you insert a cable with a plug on the end, such as aCAT5 or 6 network lead, or it can mean a software port.

Using lsof to show the details of a process using a specific port and protocol

A software port is the final part of a network connection. TheIP addressof a device identifies the computer or other network appliance. The applications inside the computer use different ports. These provide another level of granularity. The network traffic has arrived at the correct computer using the IP address, and by using port addressing it can be delivered to the correct application.

It’s like postal mail arriving at a hotel, then being sorted and delivered to the appropriate rooms. The IP address is like the street address of the hotel, and the room numbers are like the port numbers.

lsof does not work with the SCTP protocol

If you see network activity on a port and you don’t recognize the process that is generating it, or its behavior is problematic or suspicious, you might want want to kill the process. Even if all you know is the port number, you can track down the process and kill it.

Creating Connections With socat

So that we have some connections to kill, we’ll usesocatto create network connections using different protocols. You’ll need to installsocat. To install it on Ubuntu, use this command:

On Manjaro you need to type:

The syntax forsocatis straightforward if a little long-winded. We need to provide the source and destination addresses. For each of these, we need to provide the protocol, IP address, and port number. We can substitute STDIN or STDOUT as a source or destination.

This command creates a connection between a TCP listening socket on port 7889, on the loopback IP address of 127.0.0.1, and STDOUT. The ampersand “&“runs the command in the background, so that we retain access to the command line.

Printing the details of a process using an SCTP socket with ss

We’ll create two more connections so that we have a small selection of sockets using different protocols. We’ll create aUDP connectionand anSCTP connection. The only part of the command that changes is the protocol.

Related:What’s the Difference Between TCP and UDP?

Using pipes to connect ss, grep, and awk to extract the PID string

Using Kill

Of course, we can usekillto terminate the process, just as long as we know what the ID of the process is. To find the PID, we can usethelsofcommand.

To list the details of the process on port 7889 that are using the TCP protocol, we use the-i(internet address) option, like this.

Using pipes to connect ss, grep, and awk twice, to extract the PID

The PID of this process is 3141, and we can go ahead and use that withkill:

We can save ourselves some effort if we use pipes. If we pipe the output oflsofintoawkandtellawkto search for lines that contain the port we’re interested in—7889—and print the second field from that line, we’ll isolate the PID.

Using the fuser command to delete the processes using TCP and UDP sockets

We can then pipe the output fromawkinto thekillcommand usingxargs. Thexargscommand takes its piped input and passes it to another commandas command line parameters. We’ll usexargswith thekillcommand.

We don’t get any visual feedback. In the typical Linux way, no news is good news. If you want to check that the process has been terminated you’re able to uselsofonce more.

Becauselsofdoesn’t report anything, we know there’s no such connection.

We can remove a process using the UDP protocol simply by replacing “tcp” with “udp” in our earlier command.

However,lsofdoesn’t recognize the SCTP protocol.

We can usethesscommandto do that. We’re using the-S(SCTP) option to search for SCTP sockets, the-a(all) option to search for all types of sockets (listening, accepting, connected, etc.), and the-p(processes) option to list the details of the process using the socket.

We can parse that output usinggrepandawk. We could also parse it usinggrepand some PERL regexes, but this way is much easier to understand. If you were going to use this more than once or twice you’d probably make analias or shell functionout of it.

We’ll pipe the output fromssintogrepand search for our port number, 7889. We’ll pipe the output fromgrepintoawk. Inawk, we’re using the-F(separator string) option to set a comma  “,” as the field delimiter. We search for a string containing “pid=”, and print the second comma-delimited field from that string.

That has given us the string “pid=2859.”

We canpipethat intoawkagain, set the field delimiter to the equals sign “=” and print the second field from that string, which will be the text behind the equals sign.

We’ve now isolated the process ID. We can usexargsto pass the PID tokillas a command line parameter.

That kills the process that was using the SCTP protocol socket on port 7889.

The fuser Command

Thefusercommand simplifies things a great deal. The downside is, that it only works withTCP and UDPsockets. On the plus side, those are the two most common types of sockets you’ll need to deal with. Thefusercommand was already installed on the Ubuntu, Fedora, and Manjaro computers we checked.

All you need to do is use the-k(kill) option, and provide the port and protocol. You can either use the-n(namespace) option and provide the protocol and port, or use the “forward slash shortcut format” and put the port number first.

The port number, protocol, and PID of the terminated process are printed in the terminal window.

Try fuser First

It’ll probably be installed on the computer you’re working on, and the protocol is likely to be TCP or UDP, so there’s a great chance the simplest way will work for you.