MacOS – Find process associated with launchd

launchdmacmacos

TCP port 5901 is open on my machine and is causing some mischief, and I want to know which process is opening it. When I run lsof -i -P I see that launchd is the process that opened the port.

Is there a quick way I can determine which launchd plist file is being used to open that port? I'd rather not have to go through each plist mentioned by launchctl list.

Best Answer

First, is this being opened by the system launchd (process ID 1, running as root), or a user launchd (running as a user)? If it's the system launchd, you're looking for a LaunchDaemon; if it's a user launchd, you're looking for a LaunchAgent.

Assuming it's the system launchd, you can look for the relevant LaunchDaemon like this:

grep 5901 {,/System}/Library/LaunchDaemons/*

(note: if port 5901 were listed in /etc/services, you'd also have to look for it by name as well as number. But it isn't, so you don't have to worry about that.)

It's also possible that it's a LaunchDaemon that was loaded from some other place; tracking that down would be messy, so start with the easy check first.

Related Question