Pearson's OSCP Notebook

Port in Use - kill listener

Properties1
tagsport-in-use, kill, ss, lsof, fuser, troubleshooting, listeners, netcat, penelope, ligolo

6 min read

Port in Use — Find & Kill the Listener

Ctrl+F: port already in use · ss -ltnp · lsof -i · fuser -k · kill · pkill · :80 · :4444

When you see:

The port '4444' is currently in use
Address already in use
bind: Address already in use

Another process is already listening on that TCP/UDP port. Free it or pick a different port.

Kill everything on a port (any port — e.g. 80, 4444, 8080):

sudo lsof -i :80
sudo ss -ltnp 'sport = :80'
sudo fuser -k 80/tcp
sudo kill -9 $(sudo lsof -t -i:80)**

Deep socket reference → netstat · listeners on target shells → Basic Commands

📌 Quick fix (copy/paste)

# 1. What's on port 4444?
sudo ss -ltnp | grep :4444
sudo lsof -i :4444
 
# 2. Kill by PID (from output above)
kill 12345
kill -9 12345          # force
 
# Or one-liner — kill whatever holds the port
sudo fuser -k 4444/tcp
 
# 3. Confirm free — no output = good
sudo ss -ltnp | grep :4444

📌 Kill everything on port 80 (or any port)

Common when Python HTTP server, Apache, Responder, or a stuck listener holds port 80.

Step 1 — Find what’s using the port

sudo lsof -i :80
sudo ss -ltnp 'sport = :80'
sudo ss -ltnp | grep :80

Step 2 — Kill everything on that port

# Preferred one-liner — kills all PIDs using TCP port 80
sudo fuser -k 80/tcp
 
# Alternative — kill via lsof PID list
sudo kill -9 $(sudo lsof -t -i:80)

Replace 80 with any port (4444, 8080, 8000, etc.).

Step 3 — Verify free

sudo lsof -i :80
sudo ss -ltnp | grep :80
# No output = port free

Also stop by name if you know the tool:

pkill -f "http.server"
pkill -f "python3 -m http.server"
sudo systemctl stop apache2    # if system Apache holds :80

→ Responder (often binds 80) · powercat / Netcat listeners

📌 Step 1 — Find what’s using the port

Linux — TCP listener (most common)

sudo ss -ltnp | grep :4444
sudo ss -tlnp | grep 4444        # same idea
 
sudo lsof -i :4444
sudo lsof -iTCP:4444 -sTCP:LISTEN
 
netstat -tulpn | grep 4444       # classic (needs root for -p)

Example output:

COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
python3  12345  phill   5u  IPv4  ...      TCP *:4444 (LISTEN)

Note the PID (e.g. 12345) and COMMAND.

UDP

sudo ss -ulnp | grep :53
sudo lsof -i UDP:53
sudo fuser -k 53/udp

All ports for one process

sudo lsof -p 12345 -i
ps aux | grep 12345

Which process owns a PID?

ps -fp 12345
ps aux | grep 12345

📌 Step 2 — Kill the process

By PID (preferred — you know exactly what you kill)

kill 12345              # SIGTERM — graceful
kill -9 12345           # SIGKILL — force (won't save state)
kill -15 12345          # same as default kill

By port (one command)

sudo fuser -k 4444/tcp
sudo fuser -k 4444/udp

By process name

pkill nc
pkill ncat
pkill -f penelope
pkill -f ligolo
killall openvpn
killall python3         # careful — kills ALL python3

OSCP tools that often hold ports

Tool / serviceTypical portKill / stop
Netcat listener4444, 9001pkill nc · pkill ncat
Python HTTP server80, 8000, 8080pkill -f "http.server" · sudo fuser -k 80/tcp
Penelope4444pkill -f penelope
Ligolo-ngvariesps aux | grep ligolo → kill PID
Metasploit handler4444jobs -K in msf · or kill PID
Python HTTP server8000, 8080pkill -f "http.server"
impacket-smbserver445 listenerCtrl+C or kill PID
OpenVPNtunsudo killall openvpn
BloodHound CEdocker portssudo ./bloodhound-cli down
SSH -L / -D1080, 8080kill SSH background PID · pkill -f "ssh -D"
Responder80, 445Ctrl+C in terminal
# Penelope stuck
ps aux | grep -i penelope
pkill -f penelope
# Wipe saved sessions (does not uninstall): rm -rf ~/.penelope  → **[[Penelope#Safest fix: wipe Penelope's local state]]**
 
# Ligolo
ps aux | grep ligolo
kill <PID>
 
# OpenVPN / HTB VPN
sudo killall openvpn
 
# BloodHound CLI (docker stack)
sudo ./bloodhound-cli down
 
# Metasploit — inside msfconsole
jobs
jobs -K

→ Netcat · Ligolo-ng · Responder · Shell

📌 Step 3 — Verify port is free

sudo ss -ltnp | grep :4444
# No output = port free
 
sudo lsof -i :4444
# Empty = free
 
# Try binding (optional test)
nc -lvnp 4444
# Should listen without error — Ctrl+C to stop

📌 Alternative — use a different port

If you don’t need that exact port:

# Netcat — pick another
nc -lvnp 4445
 
# Metasploit
set LPORT 4445
 
# Python HTTP
python3 -m http.server 8081
 
# SSH dynamic forward
ssh -D 1081 user@PIVOT -N -f

📌 Find what’s using ANY port (scan mindset)

# All TCP listeners
sudo ss -ltnp
sudo ss -tulpn
 
# Sort by port
sudo ss -ltnp | sort -t: -k2 -n
 
# Common exam ports at once
for p in 22 80 443 445 3306 4444 5985 8080; do
  echo "=== $p ==="
  sudo ss -ltnp | grep ":$p "
done

📌 Background jobs & orphaned listeners

# Shell background jobs
jobs -l
kill %1
 
# Processes you started with -f (SSH, etc.)
ps aux | grep ssh
ps aux | grep -E 'nc|ncat|python|msf'
 
# Parent/child — kill whole tree
pkill -f "msfconsole"

📌 Windows (Kali dual-boot / target shell)

netstat -ano | findstr :4444
netstat -ano | findstr LISTENING
 
taskkill /PID 12345 /F
Get-NetTCPConnection -LocalPort 4444
Stop-Process -Id 12345 -Force

→ netstat · tasklist and Get-Process

📌 Permission errors

ErrorFix
Operation not permitted on killsudo kill PID — process owned by root/other user
ss -p shows nothingRun with sudo
Port still “in use” after killWait ~30s (TIME_WAIT) or kill -9 · check for second process
Can’t kill system servicesudo systemctl stop servicename instead of kill

📌 Quick Cheat Sheet

# Kill EVERYTHING on a port (swap PORT)
sudo lsof -i :PORT
sudo ss -ltnp 'sport = :PORT'
sudo fuser -k PORT/tcp
sudo kill -9 $(sudo lsof -t -i:PORT)
 
# Examples
sudo fuser -k 80/tcp
sudo fuser -k 4444/tcp
sudo kill -9 $(sudo lsof -t -i:8080)
 
sudo ss -ltnp | grep :PORT
sudo lsof -i :PORT
kill PID || kill -9 PID
 
# Common cleanups
pkill nc; pkill -f penelope; sudo killall openvpn
pkill -f "http.server"
sudo ./bloodhound-cli down

Graph View

Backlinks