Linux Interview Question 8: Port in Use SS
Linux Interview Questions · Test 1 · question 8 of 10
After a server reboot, nginx fails to start and its error log shows bind() to 0.0.0.0:80 failed (98: Address already in use). You suspect another service grabbed port 80 first.
Which command most directly identifies the process that is listening on TCP port 80?
Show answer and explanation
Answer:
ss (the modern replacement for netstat) inspects sockets. The flags combine as follows: -l shows only listening sockets, -t limits output to TCP, -n skips resolving port numbers to service names, and -p shows the processes using each socket (name, PID, and file descriptor). The filter sport = :80 limits output to the local port 80. sudo matters: as an unprivileged user, ss cannot show process details for sockets owned by other users, such as a root-owned daemon.
Option A is wrong because ip addr shows IP addresses assigned to interfaces. "Address already in use" refers to an IP-and-port socket pair, not an interface address.
Option B is close but fails twice. Without -l (or -a), ss omits listening sockets, and without -p it would not show which process owns a socket even if it listed one.
Option D is wrong because ip neigh shows the ARP/NDP neighbour table, which maps IP addresses on the local network to MAC addresses. It says nothing about local ports.
Reference: ss(8) - Linux manual page