Processes and ports
By the end of this lesson you can see what is running on a Linux machine, stop a program politely or by force, run a command in the background, check a system service, and find out which program is listening on a port.
Processes and PIDs
A process is a program that is running. Open two terminal windows and there are two bash processes, even though there is only one bash program on disk.
Every process has:
- a PID (process ID): a number that names it while it runs, such as
4188; - an owner: the user it runs as, which decides what it is allowed to touch (see Permissions);
- a parent: the process that started it. When you type
ls, your shell is the parent ofls.
systemd (PID 1) started first, starts everything else
└── gnome-terminal
└── bash (4120) your shell
├── ls (4188) a command you typed: runs, prints, ends
└── python3 (4201) a server you left runningList processes with ps
ps on its own lists the processes in this terminal:
sam@laptop:~$ ps
PID TTY TIME CMD
4120 pts/0 00:00:00 bash
4188 pts/0 00:00:00 psTo see every process on the machine, use ps aux (all users, with the user, in full). The list is long, so filter it with grep, or use pgrep:
sam@laptop:~$ ps aux | grep sleep
sam 4302 0.0 0.0 17656 8020 pts/0 S 17:51 0:00 sleep 300
sam 4305 0.0 0.0 17808 2360 pts/0 S+ 17:51 0:00 grep sleep
sam@laptop:~$ pgrep -a sleep
4302 sleep 300The | sends the output of ps aux to grep, which keeps only the lines containing sleep. That is a pipe, the subject of the next lesson. Notice that grep sleep finds itself; pgrep does not have that problem.
The ps aux columns you need most are USER, PID, %CPU, %MEM and COMMAND. STAT is the state: R running, S sleeping (waiting for something, which is normal), Z a zombie (finished, but its parent has not noticed yet).
Watch them live with top
ps is a snapshot. top refreshes every few seconds, with the busiest processes at the top:
Key in top | What it does |
|---|---|
| P | Sort by CPU (the default) |
| M | Sort by memory |
| k | Send a signal to a process: it asks for the PID |
| q | Quit |
htop is a friendlier version with colours and scrolling, if it is installed. SysVitals, at the end of this lesson, shows the same information along with ports and disks.
Stop a process: signals and kill
You stop a process by sending it a signal: a short message from the system. Three matter most:
| Signal | Number | How you send it | What it means |
|---|---|---|---|
SIGINT | 2 | Ctrl + C in its terminal | "Interrupt": stop what you are doing |
SIGTERM | 15 | kill PID | "Please quit." The program can save its work and tidy up first |
SIGKILL | 9 | kill -KILL PID or kill -9 PID | "Stop now." The system ends it at once; it gets no chance to clean up |
Despite its name, kill sends SIGTERM unless you say otherwise. Always try SIGTERM first, wait a few seconds, and use SIGKILL only if the program ignores it. A program killed with SIGKILL can leave half-written files and lock files behind.
Try it with sleep, a harmless command that waits for the number of seconds you give it:
sam@laptop:~$ sleep 300 &
[1] 4302
sam@laptop:~$ kill 4302
[1]+ Terminated sleep 300You can only signal your own processes. For anyone else's you get Operation not permitted, which is a good reason to stop and think rather than reaching for sudo. pkill name signals every process with that name, so use it carefully.
Background jobs
A command normally holds your terminal until it ends. A job is a command started from this shell, and you can move jobs between the foreground and the background:
| Type | What it does |
|---|---|
command & | Starts it in the background. You get the prompt back at once, with its job number and PID: [1] 4302 |
jobs | Lists this shell's jobs |
| Ctrl + Z | Pauses the foreground job and gives you the prompt back |
bg | Lets the paused job carry on, in the background |
fg | Brings a job back to the foreground, where Ctrl + C can stop it |
kill %1 | Sends SIGTERM to job 1, without needing its PID |
sam@laptop:~$ sleep 300 &
[1] 4310
sam@laptop:~$ jobs
[1]+ Running sleep 300 &
sam@laptop:~$ kill %1
[1]+ Terminated sleep 300Background jobs belong to the terminal. Close the terminal and they normally stop too.
Services and systemctl
A service (also called a daemon) is a program that runs in the background all the time, usually started when the computer boots: the SSH server, a web server, a database, the printing system. On most Linux distributions systemd looks after services, and you talk to it with systemctl.
sam@laptop:~$ systemctl status cron
● cron.service - Regular background program processing daemon
Loaded: loaded (/usr/lib/systemd/system/cron.service; enabled; preset: enabled)
Active: active (running) since Sat 2026-11-07 18:51:32 IST; 1 day 22h ago
…Active tells you whether it is running now; enabled means it starts at boot. Press q if the output opens in a pager.
| Command | What it does | Needs sudo? |
|---|---|---|
systemctl status NAME | Shows whether it runs, and its latest log lines | No |
systemctl list-units --type=service --state=running | Lists running services | No |
sudo systemctl restart NAME | Stops and starts it, for example after a config change | Yes |
sudo systemctl stop NAME / start NAME | Stops or starts it until the next boot | Yes |
sudo systemctl enable NAME / disable NAME | Starts it at every boot, or stops doing so | Yes |
Stop services with systemctl, not with kill: systemd may start a killed service again, and systemctl stop shuts it down in the right order.
Ports: what is listening
A program that accepts network connections listens on a port: a number from 1 to 65535 that says which program on the machine a connection is for. A web server usually listens on 80 or 443, SSH on 22, and a development server on something like 3000, 8000 or 8080. Only one program can listen on a given port and address at a time.
ss (socket statistics) shows the listening ports. Start a small web server in the background to have something to look at. python3 -m http.server serves the files in the current folder; --bind 127.0.0.1 keeps it reachable from this machine only:
sam@laptop:~/practice$ python3 -m http.server 8099 --bind 127.0.0.1 &
[1] 4410
Serving HTTP on 127.0.0.1 port 8099 (http://127.0.0.1:8099/) ...
sam@laptop:~/practice$ ss -tlnp
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 5 127.0.0.1:8099 0.0.0.0:* users:(("python3",pid=4410,fd=3))
LISTEN 0 4096 0.0.0.0:22 0.0.0.0:*
…| Option | Means |
|---|---|
-t | TCP sockets (-u for UDP) |
-l | Listening sockets only |
-n | Numbers, not names: 22, not ssh |
-p | Show the process: name, PID |
Read the Local Address column carefully:
| Address | Who can connect |
|---|---|
127.0.0.1:8099 or [::1]:8099 | Only programs on this machine (the loopback address) |
0.0.0.0:22 or [::]:22 or *:22 | Any machine that can reach this one over the network, unless a firewall blocks it |
The Process column shows only your own processes. The SSH server above belongs to root, so its process is hidden; sudo ss -tlnp shows every one.
To answer "what is on port 8099?" directly, filter: ss -tlnp | grep 8099. Then stop it with kill 4410, or kill %1 from the same terminal. If you start a second server on a port that is already taken, it fails with OSError: [Errno 98] Address already in use. That error almost always means an old copy of your program is still running.
SysVitals: one view of all this
SysVitals puts processes, connections and listening ports in one terminal window:
- The Processes tab is like
top: sort with c (CPU) or m (memory), filter with /, and press x to stop the selected process. It asks[t] SIGTERM [k] SIGKILL, the same choice askill. See Watch and stop processes. - The Ports tab is like
ss -tlnp, with the service name for well-known ports. Rows listening on all interfaces (0.0.0.0or::) are shown in yellow. See Network connections and ports. ./sysvitals.py --dumpprints everything once as plain text.
As with ss, a normal user sees the program behind their own sockets only; others show -.
Stay safe
SIGTERMbeforeSIGKILL. Give programs the chance to save their work. Check the PID and the name before you send anything.- Do not kill what you do not recognise. System processes keep your desktop, network and disks working. Look a name up before you stop it, and leave root's processes alone.
- Listen on
127.0.0.1while developing. A development server, database or mock on0.0.0.0can be reached by others on the same Wi-Fi. Many tools, includingpython3 -m http.server, listen on all interfaces unless you tell them otherwise. - Close what you open. Stop test servers when you finish, so they do not keep a port busy or stay reachable.
- Only on machines you own or are allowed to manage. Restarting a service on a shared server affects everyone using it.
Check yourself
Question 1 of 6
What does kill 4302 send, if you give no signal?
What you learned
- A process is a running program with a PID, an owner and a parent.
ps aux,pgrepandtopshow what is running.kill PIDsendsSIGTERM(please quit);kill -KILL PIDsendsSIGKILL(stop now). TrySIGTERMfirst.&,jobs,fg,bgand Ctrl + Z manage jobs in your terminal.systemctlchecks, starts, stops and enables services.ss -tlnpshows what is listening;127.0.0.1is local only,0.0.0.0is open to the network.