macOS Network – How to View PID of Process Listening on Port Using netstat

command linemacosNetwork

For *nix we can use

  netstat -anp

specifically the -p option. This is not supported on macOS. I also tried -b and -o which do not work. So how is this done on macOS?

Best Answer

Try using the -v option for verbose output. That will give, well, verbose results so you can filter a bit with -p and then maybe pipe to grep for your port number. Something like this to find the process using TCP protocol on port 80:

netstat -anv -p tcp | grep "*.80"

Here's a helpful resource with other options: https://www.btaz.com/mac-os-x/find-the-process-listening-to-port-on-mac-os-x/

Related Solutions

MacOS – How to determine what process has opened a network connection

> lsof -i :58199
COMMAND   PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
Transmiss 304 Fyodor    8u  IPv4 0x2fbc34fe135e3895      0t0  UDP *:58199

lsof = list open files. See manual for more details.

/usr/sbin/lsof

You can see with "ps -ef" more info about the PID "lsof" gave you.

Unkown process listening at port 8080

I noticed this very problem on my Macbook. I was trying to use port 8080 for some testing and I received the error that another process was already listening on it. My invocation of nmap returned different results depending on whether I was using sudo or not. This did not make sense to me.

I was really concerned when I could not figure out what was processes were listening on these ports using sudo lsof -P -n -iTCP | grep LIST. This led me to believe that there was malicious software intentionally hiding itself.

I ended up removing files from /Library/LaunchDaemons/ until I narrowed it down to the culprit. The application responsible for all these opened ports was the Cisco AnyConnect Secure Mobile Client. Unfortunately, in order for this Cisco VPN client to work, it must have all these ports opened. Apparently, it is also responsible for the firewall rule addition that you reported with ipfw show.

It still boggles my mind why it does not show which process is responsible for the open ports when using lsof. No application should be able to avoid being listed using this method. Perhaps the reason for the process not being listed will be answered in another stackexchange question.

Best Answer

Related Solutions

MacOS – How to determine what process has opened a network connection

Unkown process listening at port 8080

Related Question