MacOS – How to find which process has opened the port on macOS

macosNetwork

using netstat we can find LISTENing or open port etc.
I want to know how can we find out which process has opened which port we see in the result of

netstat -vanp tcp

Best Answer

As @klanomath mentioned in a comment, the output from netstat -vanp tcp contains the process ID of the process that has the port open (it's the next-to-last field), so you can look it up by that:

$ netstat -vanp tcp
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)     rhiwat shiwat    pid   epid
...
tcp4       0      0  127.0.0.1.631          *.*                    LISTEN      131072 131072  14636      0
                                                                                              ^^^^^
$ ps 14636
  PID   TT  STAT      TIME COMMAND
14636   ??  Ss     3:55.43 /usr/sbin/cupsd -l

So in this example, it's cupsd (the Common UNIX Printing System Daemon) listening on port 631 (for IPP, the Internet Printing Protocol).

You can also use lsof -i, with many options to narrow down the search; see man lsof for details. But note that you need to run it as root (i.e. with sudo) to see processes you don't own:

$ sudo lsof -i :631
Password: [admin password doesn't echo]
COMMAND   PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
cupsd   14636 root    5u  IPv6 0xc9c73d98b1fafae5      0t0  TCP localhost:ipp (LISTEN)
cupsd   14636 root    6u  IPv4 0xc9c73d98b3b2548d      0t0  TCP localhost:ipp (LISTEN)

Related Solutions

Unkown process listening at port 8080

I noticed this very problem on my Macbook. I was trying to use port 8080 for some testing and I received the error that another process was already listening on it. My invocation of nmap returned different results depending on whether I was using sudo or not. This did not make sense to me.

I was really concerned when I could not figure out what was processes were listening on these ports using sudo lsof -P -n -iTCP | grep LIST. This led me to believe that there was malicious software intentionally hiding itself.

I ended up removing files from /Library/LaunchDaemons/ until I narrowed it down to the culprit. The application responsible for all these opened ports was the Cisco AnyConnect Secure Mobile Client. Unfortunately, in order for this Cisco VPN client to work, it must have all these ports opened. Apparently, it is also responsible for the firewall rule addition that you reported with ipfw show.

It still boggles my mind why it does not show which process is responsible for the open ports when using lsof. No application should be able to avoid being listed using this method. Perhaps the reason for the process not being listed will be answered in another stackexchange question.

MacOS – Find process associated with launchd

First, is this being opened by the system launchd (process ID 1, running as root), or a user launchd (running as a user)? If it's the system launchd, you're looking for a LaunchDaemon; if it's a user launchd, you're looking for a LaunchAgent.

Assuming it's the system launchd, you can look for the relevant LaunchDaemon like this:

grep 5901 {,/System}/Library/LaunchDaemons/*

(note: if port 5901 were listed in /etc/services, you'd also have to look for it by name as well as number. But it isn't, so you don't have to worry about that.)

It's also possible that it's a LaunchDaemon that was loaded from some other place; tracking that down would be messy, so start with the easy check first.

Best Answer

Related Solutions

Unkown process listening at port 8080

MacOS – Find process associated with launchd

Related Question