There's more...

An arguably better way of determining which process is using which port is to use the lsof command. I say arguably because it's not usually installed by default, though it is extremely handy and powerful.

If we use lsof and check for commands using port 22, we get the following list:

$ sudo lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 877 root 3u IPv4 17409 0t0 TCP *:ssh (LISTEN)
sshd 877 root 4u IPv6 17479 0t0 TCP *:ssh (LISTEN)
sshd 4262 root 3u IPv4 43232 0t0 TCP centos1:ssh->gateway:36116 (ESTABLISHED)
sshd 4265 vagrant 3u IPv4 43232 0t0 TCP centos1:ssh->gateway:36116 (ESTABLISHED)

If you don't want to print hostnames (centos1 in the above example) and port names (ssh above) you can use the following extra flags instead ( P & n:)

$ sudo lsof -Pni :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 3454 root 3u IPv4 26892 0t0 TCP *:22 (LISTEN)
sshd 3454 root 4u IPv6 26894 0t0 TCP *:22 (LISTEN)
sshd 3457 root 3u IPv4 26951 0t0 TCP 10.0.2.15:22->10.0.2.2:33066 (ESTABLISHED)
sshd 3460 vagrant 3u IPv4 26951 0t0 TCP 10.0.2.15:22->10.0.2.2:33066 (ESTABLISHED)

If we have our Python web server enabled on 2222, we get this:

$ sudo lsof -i :2222
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
python 4542 vagrant 3u IPv4 45493 0t0 TCP *:EtherNet/IP-1 (LISTEN)

Notice that while the NAME is still listed as EtherNet, we know it's Python because the COMMAND is listed as such.

Because we also have PID (4542), we can get the full command easily:

$ ps aux | grep 4542
vagrant 4542 0.0 2.0 97820 10136 pts/2 S 15:39 0:00 python -m SimpleHTTPServer 2222