Who is listening on a given TCP port on Mac OS X

Question

On Linux  I can use netstat -pntl   grep  PORT or fuser -n tcp  PORT to find out which process  PID  is listening on the specified TCP port  How do I get the same information on Mac OS X

User · Answer

For macOS I use two commands together to show information about the processes listening on the machine and process connecting to remote servers. In other words, to check the listening ports and the current (TCP) connections on a host you could use the two following commands together

1. netstat -p tcp -p udp 

2. lsof -n -i4TCP -i4UDP

Thought I would add my input, hopefully it can end up helping someone.

User · Answer

On the latest macOS version you can use this command   lsof -nP -i4TCP  PORT   grep LISTEN     If you find it hard to remember then maybe you should create a bash function and export it with a friendlier name like so  vi    bash profile   and then add the following lines to that file and save it   function listening on         lsof -nP -i4TCP   1    grep LISTEN     Now you can type listening on 80 in your Terminal and see which process is listening on port 80

User · Answer

For the LISTEN  ESTABLISHED and CLOSED ports sudo lsof -n -i -P   grep TCP  For the LISTEN ports only sudo lsof -n -i -P   grep LISTEN  For a specific LISTEN port  ex  port 80 sudo lsof -n -i -P   grep   80  LISTEN    Or if you just want a compact summary  no service apps described   go by NETSTAT  The good side here is  no sudo needed netstat -a -n   grep  LISTEN    Explaining the items used  -n suppress the host name -i for IPv4 and IPv6 protocols -P omit port names -a  over netstat  for all sockets -n  over netstat  don t resolve names  show network addresses as numbers  Tested on High Sierra 10 13 3 and Mojave 10 14 3  the last syntax netstat works on linux too

User · Answer

You can also use    sudo lsof -i -n -P   grep TCP   This works in Mavericks

User · Answer

Update January 2016  Really surprised no-one has suggested   lsof -i  PORT NUMBER   to get the basic information required  For instance  checking on port 1337   lsof -i  1337   Other variations  depending on circumstances   sudo lsof -i  1337 lsof -i tcp 1337   You can easily build on this to extract the PID itself  For example   lsof -t -i  1337   which is also equivalent  in result  to this command   lsof -i  1337   awk    print  2       head -n 2   grep -v PID   Quick illustration     For completeness  because frequently used together   To kill the PID   kill -9  lt PID gt    kill -9 60401   or as a one liner   kill -9   lsof -t -i  1337

User · Answer

on OS X you can use the -v option for netstat to give the associated pid   type   netstat -anv   grep    PORT   the output will look like this   tcp46      0      0    8080                                        LISTEN      131072 131072   3105      0   The PID is the number before the last column  3105 for this case

User · Answer

lsof -n -i   awk    print  1  9       sort -u   This displays who s doing what  Remove -n to see hostnames  a bit slower

User · Answer

This did what I needed   ps -eaf   grep  lsof -t -i  PORT

User · Answer

This is a good way on macOS High Sierra       netstat -an  grep -i listen

User · Answer

I am a Linux guy  In Linux it is extremely easy with netstat -ltpn or any combination of those letters  But in Mac OS X netstat -an   grep LISTEN is the most humane  Others are very ugly and very difficult to remember when troubleshooting

User · Answer

This works in Mavericks  OSX 10 9 2    sudo lsof -nP -iTCP  PORT -sTCP LISTEN

User · Answer

I made a small script to see not only who is listening where but also to display established connections and to which countries  Works on OSX Siera     bin bash printf   nchecking established connections n n  for i in   sudo lsof -i -n -P   grep TCP   grep ESTABLISHED   grep -v IPv6    grep -v 127 0 0 1   cut -d   gt   -f2   cut -d     -f1   cut -d     -f1   do     printf   i      amp  curl freegeoip net xml  i -s -S   grep CountryName    cut -d   gt   -f2   cut -d  lt   -f1 done  printf   ndisplaying listening ports n n   sudo lsof -i -n -P   grep TCP   grep LISTEN   cut -d     -f 1 32-35   EOF     Sample output checking established connections  107 178 244 155   United States 17 188 136 186   United States 17 252 76 19   United States 17 252 76 19   United States 17 188 136 186   United States 5 45 62 118   Netherlands 40 101 42 66   Ireland 151 101 1 69   United States 173 194 69 188   United States 104 25 170 11   United States 5 45 62 49   Netherlands 198 252 206 25   United States 151 101 1 69   United States 34 198 53 220   United States 198 252 206 25   United States 151 101 129 69   United States 91 225 248 133   Ireland 216 58 212 234   United States  displaying listening ports  mysqld TCP   3306  LISTEN  com avast TCP 127 0 0 1 12080  LISTEN  com avast TCP    1  12080  LISTEN  com avast TCP 127 0 0 1 12110  LISTEN  com avast TCP    1  12110  LISTEN  com avast TCP 127 0 0 1 12143  LISTEN  com avast TCP    1  12143  LISTEN  com avast TCP 127 0 0 1 12995  LISTEN  com avast    1  12995  LISTEN  com avast 127 0 0 1 12993  LISTEN  com avast    1  12993  LISTEN  Google TCP 127 0 0 1 34013  LISTEN      This may be useful to check if you are connected to north-korea   -

User · Answer

Since Snow Leopard  up to Catalina and Big Sur  every version of macOS supports this  sudo lsof -iTCP -sTCP LISTEN -n -P Personally I ve end up with this simple function in my    bash profile  listening         if      -eq 0    then         sudo lsof -iTCP -sTCP LISTEN -n -P     elif      -eq 1    then         sudo lsof -iTCP -sTCP LISTEN -n -P   grep -i --color  1     else         echo  quot Usage  listening  pattern  quot      fi    Then listening command gives you a listing of processes listening on some port and listening smth greps this for some pattern  Having this  it s quite easy to ask about particular process  e g  listening dropbox  or port  e g  listening 22  lsof command has some specialized options for asking about port  protocol  process etc  but personally I ve found above function much more handy  since I don t need to remember all these low-level options  lsof is quite powerful tool  but unfortunately not so comfy to use

User · Answer

On Snow Leopard  OS X 10 6 8   running  man lsof  yields   lsof -i 4 -a    actual manual entry is  lsof -i 4 -a -p 1234    The previous answers didn t work on Snow Leopard  but I was trying to use  netstat -nlp  until I saw the use of  lsof  in the answer by pts

User · Answer

Inspired by user Brent Self   lsof -i 4 -a   grep LISTEN

User · Answer

On macOS Big Sur and later  use this command  sudo lsof -i -P   grep LISTEN  or to just see just IPv4  sudo lsof -nP -i4TCP  PORT   grep LISTEN  On older versions  use one of the following forms  sudo lsof -nP -iTCP  PORT   grep LISTEN sudo lsof -nP -i  PORT   grep LISTEN  Substitute  PORT with the port number or a comma-separated list of port numbers  Prepend sudo  followed by a space  if you need information on ports below  1024  The -n flag is for displaying IP addresses instead of host names  This makes the command execute much faster  because DNS lookups to get the host names can be slow  several seconds or a minute for many hosts   The -P flag is for displaying raw port numbers instead of resolved names like http  ftp or more esoteric service names like dpserve  socalia  See the comments for more options  For completeness  because frequently used together  To kill the PID  sudo kill -9  lt PID gt    kill -9 60401

User · Answer

On macOS  here s an easy way to get the process ID that s listening on a specific port with netstat  This example looks for a process serving content on port 80   find server running on port 80  netstat -anv   egrep -w    80  LISTEN   sample output  tcp4  0 0    80              LISTEN      131072 131072    715      0   The 2nd from the last column is the PID   In above  it s 715   options  -a - show all ports  including those used by servers  -n - show numbers  don t look up names  This makes the command a lot faster  -v - verbose output  to get the process IDs  -w - search words  Otherwise the command will return info for ports 8000 and 8001  not just  80   LISTEN - give info only for ports in LISTEN mode  i e  servers

[macos] Who is listening on a given TCP port on Mac OS X?

Examples related to macos

Examples related to tcp

Examples related to netstat

Examples related to listen