Let’s say you run nmap on your local box and you see an open port, but don’t know which program is listening on that port. Wouldn’t it be great to be able to find out? The program you need to find this information is lsof, or list open files. This program can show you a lot of information about open files, ports and directories.

Let’s go back to the original question. Run the following command.

sudo lsof -i4:80

With this command we get a list of programs which listen or connect to port 80. Its output should look like this:

COMMAND     PID     USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
apache2    3080     root    4u  IPv4   13546      0t0  TCP *:www (LISTEN)
apache2    3123 www-data    4u  IPv4   13546      0t0  TCP *:www (LISTEN)
apache2    3124 www-data    4u  IPv4   13546      0t0  TCP *:www (LISTEN)
apache2    3125 www-data    4u  IPv4   13546      0t0  TCP *:www (LISTEN)
apache2    3126 www-data    4u  IPv4   13546      0t0  TCP *:www (LISTEN)
apache2    3127 www-data    4u  IPv4   13546      0t0  TCP *:www (LISTEN)
apache2   18335 www-data    4u  IPv4   13546      0t0  TCP *:www (LISTEN)
apache2   18337 www-data    4u  IPv4   13546      0t0  TCP *:www (LISTEN)

This shows you all local running processes that LISTEN on the www port. This could also show open connections to other web servers.