03 / FIELD NOTES

Find who holds port 8080

Find the process listening on 8080 when CrowdSec local API cannot start.

Why this way

CrowdSec failing on a fresh box is often “something else already owns 8080”, not a bad install. Look with ss before you rewrite three YAML files.

When to use

The CrowdSec local API fails because 127.0.0.1:8080 is already taken.

When not to

This only lists the listener. Changing the LAPI port means editing three CrowdSec files together.

Prerequisites

ss from iproute2
permission to see process names

Steps

List listeners on port 8080

Read-only

ss -lptn 'sport = :8080'

Expect: A process name and pid, or no rows if the port is free.

What it changes

Read-only. The default is 127.0.0.1:8080 in config.yaml, local_api_credentials.yaml, and the firewall bouncer file. Change all three, then restart both services.

{
  "slug": "crowdsec-8080",
  "risk": "safe",
  "tags": [
    "crowdsec",
    "8080",
    "ss"
  ],
  "updated": "2026-10-28",
  "pathIndex": null,
  "why": "CrowdSec failing on a fresh box is often “something else already owns 8080”, not a bad install. Look with ss before you rewrite three YAML files.",
  "steps": [
    {
      "command": "ss -lptn 'sport = :8080'",
      "risk": "safe"
    }
  ]
}