I have been trying to debug something which I have running on an apache/mysql setup (because the max connections is being exceeded and some processes seem to hang around). You can find out what is using port 80 with this command:
lsof -i tcp:80
And you can see what a particular command is by running this on the PID you get from the above:
ps -lf -p <PID>
I went a bit further, so the following will allow you to watch the TCP connections on port 80 and see what command is being run:
watch -d -n 1 "lsof -i tcp:80 | sort -u -k2 -n | awk '{printf \$2 \" \" \$8; if (NR != 1) {system(\"echo -ne \\\" \\\"; ps -lf -p \" \$2 \" | grep \" \$2)} else {print \" F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY TIME CMD\"}}' | awk '{printf \$1\"__\"substr(\$2,1,20)\"__\"\$5\"__\"\$6\"__\"\$14\"__\"\$16\"__\";for (i=17; i<=NF; i++) { printf(\"%s \", \$i)} printf(\"\n\")}' | column -t -s \"__\""
It’s a bit long, but what it is basically doing is concatenating the two commands and pretty printing it. That command is escaped and passed into the watch command so that it updates every second. It also highlights changes (the -d), uniqifies the output of the lsof command (| sort -u -k2 -n) so that the same process only shows once – I was getting the IP and host name both being displayed – and only displays certain columns.