Macos – How to close suspicious port 999 garcon, is it malware

Try using

lsof | grep portnumber

to get the process that has it opened.

You could also use the -i option to let lsof do the filtering for a TCP port

lsof -i TCP:portnumber

You can't close an open socket just like this. Ideally, you would just kill the process that has established the connection.

Check your connections with lsof (netstat won't show the process), filtering the output with whatever connection status you want:

lsof -i
lsof -i | grep LISTEN
lsof -i | grep ESTABLISHED

Or, to get the port, e.g. 17500:

lsof -i:17500

Then, just kill the process. For example:

$ lsof -i | grep "Skype"
Skype     438 werner    9u  IPv4 0xffffff801dd0c640      0t0  UDP localhost:52218
Skype     438 werner   42u  IPv4 0xffffff80231a7a08      0t0  TCP *:29429 (LISTEN)
Skype     438 werner   43u  IPv4 0xffffff8022e18a40      0t0  UDP *:29429

Kill Skype:

killall Skype

Note though that this won't prevent the connections from being made – something you have to specify in your Firewall preferences.