Search code examples
ubuntuwindows-subsystem-for-linux

Mystery process listening on port 8000; how to figure out the process and kill it?


I am on WSL 2 running Ubuntu v 22.04. Some process (or something) is listening on port 8000 (this just started to happen). When I execute the command ss -ltnp, I get the following output. It seems there is no process id (PID) associated with whatever is listening in on port 8000.

State   Recv-Q  Send-Q   Local Address:Port     Peer Address:Port  Process
LISTEN  0       4096         127.0.0.1:6443          0.0.0.0:*
LISTEN  0       4096     127.0.0.53%lo:53            0.0.0.0:*
LISTEN  0       128            0.0.0.0:8888          0.0.0.0:*      users:(("jupyter-lab",pid=42658,fd=7))
LISTEN  0       511          127.0.0.1:44063         0.0.0.0:*      users:(("node",pid=54681,fd=22))
LISTEN  0       511          127.0.0.1:37249         0.0.0.0:*      users:(("node",pid=54374,fd=20))
LISTEN  0       4096                 *:80                  *:*
LISTEN  0       128               [::]:8888             [::]:*      users:(("jupyter-lab",pid=42658,fd=8))
LISTEN  0       4096                 *:8000                *:*

I also tried lsof -i TCP:8000 and nothing came back. Although, for port 8888, just for a sanity check, lsof -i TCP:8888, I did get something back.

Any ideas on how to find out the PID associated with listening on port 8000? Assuming there is a PID associated, then I can proceed to kill it kill -i [PID].

By the way, here are some drastic measures I've tried to "clear" out whatever is listening on port 8000.

  • Reboot the entire machine (Windows)
  • Terminate wsl --terminate ubuntu and shutdown wsl --shutdown

Solution

  • Since I was running on WSL 2 with Ubuntu, ss -ltnp could identify something was listening on port 8000. However, on Windows itself, the following command identified that the PID was actually on Windows: netstat -ano | findstr :8000.

    TCP    0.0.0.0:8000           0.0.0.0:0              LISTENING       12116
    TCP    [::]:8000              [::]:0                 LISTENING       12116
    TCP    [::1]:8000             [::]:0                 LISTENING       13992
    

    That PID 12116 was mapped to "Docker Desktop Backend". When I stopped Docker Desktop, the port was freed.