On Linux, I can use netstat -pntl | grep $PORT
or fuser -n tcp $PORT
to find out which process (PID) is listening on the specified TCP port. How do I get the same information on Mac OS X?
![](../../users/profiles/97248.webp)
- 64,123
- 15
- 92
- 159
-
28Sorry, `netstat -p tcp | grep $PORT` doesn't display PIDs since netstat on the Mac OS X cannot display PIDs. – pts Dec 12 '10 at 12:39
-
17`netstat -anv` displays the port on Mac OS X (source: solution below by @SeanHamiliton) – Curtis Yallop Apr 26 '18 at 21:02
17 Answers
On macOS Big Sur
and later, use this command:
sudo lsof -i -P | grep LISTEN
or to just see just IPv4:
sudo lsof -nP -i4TCP:$PORT | grep LISTEN
On older versions, use one of the following forms:
sudo lsof -nP -iTCP:$PORT | grep LISTEN
sudo lsof -nP -i:$PORT | grep LISTEN
Substitute $PORT
with the port number or a comma-separated list of port numbers.
Prepend sudo
(followed by a space) if you need information on ports below #1024.
The -n
flag is for displaying IP addresses instead of host names. This makes the command execute much faster, because DNS lookups to get the host names can be slow (several seconds or a minute for many hosts).
The -P
flag is for displaying raw port numbers instead of resolved names like http
, ftp
or more esoteric service names like dpserve
, socalia
.
See the comments for more options.
For completeness, because frequently used together:
To kill the PID:
sudo kill -9 <PID>
# kill -9 60401
![](../../users/profiles/5562045.webp)
- 2,348
- 19
- 31
![](../../users/profiles/97248.webp)
- 64,123
- 15
- 92
- 159
-
158
-
30
-
59On Mountain Lion, you don't need `grep`: `sudo lsof -iTCP:$PORT -sTCP:LISTEN` – Siu Ching Pong -Asuka Kenji- Jul 12 '13 at 20:54
-
16after so many searches this one is the best. people who directly want to copy the command should replace $PORT with actual port number or define the variable PORT and that too for multiple ports like: export PORT=8080,4433; lsof -n -i4TCP:$PORT – siddhusingh Mar 02 '14 at 12:06
-
1On my _OSX 10.9.2_ it even runs without the preceding `sudo`. Might give that a try, as it enables you to run it without entering a password. :) – Tom Fink Mar 12 '14 at 10:24
-
2
-
All three work for me on Sierra, but I needed sudo even for a port above 1024 - perhaps it depends on who's running the process. – mwfearnley Oct 30 '17 at 15:49
-
@meagar - you rolled back my edit to include the OS version. Was it factually incorrect or what was the reason for the rollback? I think it makes sense to note which commands work on what OS X versions, so people easier find the appropriate command. – Per Lundberg Feb 16 '18 at 13:21
-
-
Handy one line command to kill a process on a TCP port `read K_PORT; lsof -iTCP:$K_PORT -sTCP:LISTEN | tail -n 1 | awk '{ print $2 }' | xargs kill -9` – Vasu Adari Jun 27 '20 at 12:21
-
-
Instead of `| grep LISTEN` I recommend using sed so you can also see the column headers `| sed -n '1p;/LISTEN/p'` – Jeff Feb 11 '21 at 15:55
Since Snow Leopard, up to Catalina and Big Sur, every version of macOS supports this:
sudo lsof -iTCP -sTCP:LISTEN -n -P
Personally I've end up with this simple function in my ~/.bash_profile
:
listening() {
if [ $# -eq 0 ]; then
sudo lsof -iTCP -sTCP:LISTEN -n -P
elif [ $# -eq 1 ]; then
sudo lsof -iTCP -sTCP:LISTEN -n -P | grep -i --color $1
else
echo "Usage: listening [pattern]"
fi
}
Then listening
command gives you a listing of processes listening on some port and listening smth
greps this for some pattern.
Having this, it's quite easy to ask about particular process, e.g. listening dropbox
, or port, e.g. listening 22
.
lsof
command has some specialized options for asking about port, protocol, process etc. but personally I've found above function much more handy, since I don't need to remember all these low-level options. lsof
is quite powerful tool, but unfortunately not so comfy to use.
![](../../users/profiles/1288294.webp)
- 14,509
- 4
- 31
- 44
-
10This is going in my dotfiles. I search every few months and always come upon this answer. – danemacmillan May 09 '19 at 16:32
-
1I feel this should be accepted answer as OP said he does `-pntl`, which would list all services. The accepted answer asks for one or more port numbers to be specified, which is not remotely the same. – seeafish Nov 07 '19 at 15:26
You can also use:
sudo lsof -i -n -P | grep TCP
This works in Mavericks.
![](../../users/profiles/1524733.webp)
- 4,599
- 1
- 11
- 4
-
3The `-i` option makes it significantly faster. 0.02 seconds vs 2 seconds. In my application this made quite the difference. – Eric Boehs Dec 20 '14 at 03:04
-
what do those specific flags do -i, -n, -P. I can't find anywhere what they mean exactly – Chad Watkins Apr 30 '15 at 17:26
-
sudo lsof -i -n -P | grep TCP | grep $PORT - I made an alias with this command – alyn000r Aug 01 '16 at 20:55
-
-
Update January 2016
Really surprised no-one has suggested:
lsof -i :PORT_NUMBER
to get the basic information required. For instance, checking on port 1337:
lsof -i :1337
Other variations, depending on circumstances:
sudo lsof -i :1337
lsof -i tcp:1337
You can easily build on this to extract the PID itself. For example:
lsof -t -i :1337
which is also equivalent (in result) to this command:
lsof -i :1337 | awk '{ print $2; }' | head -n 2 | grep -v PID
Quick illustration:
For completeness, because frequently used together:
To kill the PID:
kill -9 <PID>
# kill -9 60401
or as a one liner:
kill -9 $(lsof -t -i :1337)
![](../../users/profiles/1882064.webp)
- 29,753
- 14
- 104
- 117
-
2This command also displays non-listener PIDs, and the questions explicitly asked for listeners only. – pts Jan 07 '16 at 17:41
-
3You can also run `lsof -t -i :1338`. `-t` will return the process id, so you won't have to awk/head. – KFunk Aug 19 '16 at 21:10
-
-
This is great. I prefer to know what's there before I kill it, so (based on this) I just added to my bashrc: `whatsonport() { ps -ef | grep \`lsof -t -i :$1\` }`, so: ```⇒ whatsonport 3000 --> 501 14866 14865 0 6:07AM ttys006 0:01.73 node .``` – Sigfried Apr 13 '17 at 10:24
-
1
This works in Mavericks (OSX 10.9.2).
sudo lsof -nP -iTCP:$PORT -sTCP:LISTEN
![](../../users/profiles/90874.webp)
- 19,314
- 5
- 82
- 97
![](../../users/profiles/3626970.webp)
- 791
- 5
- 3
For the LISTEN, ESTABLISHED and CLOSED ports
sudo lsof -n -i -P | grep TCP
For the LISTEN ports only
sudo lsof -n -i -P | grep LISTEN
For a specific LISTEN port, ex: port 80
sudo lsof -n -i -P | grep ':80 (LISTEN)'
Or if you just want a compact summary [no service/apps described], go by NETSTAT. The good side here is, no sudo needed
netstat -a -n | grep 'LISTEN '
Explaining the items used:
-n suppress the host name
-i for IPv4 and IPv6 protocols
-P omit port names
-a [over netstat] for all sockets
-n [over netstat] don't resolve names, show network addresses as numbers
Tested on High Sierra 10.13.3 and Mojave 10.14.3
- the last syntax netstat works on linux too
-
The detail explanations are actually very useful for beginners like me. thanks @PYK – Tomaz Wang May 29 '19 at 08:40
on OS X you can use the -v option for netstat to give the associated pid.
type:
netstat -anv | grep [.]PORT
the output will look like this:
tcp46 0 0 *.8080 *.* LISTEN 131072 131072 3105 0
The PID is the number before the last column, 3105 for this case
![](../../users/profiles/2682019.webp)
- 282
- 1
- 7
![](../../users/profiles/5505100.webp)
- 571
- 4
- 3
-
-
3This is what I needed! `lsof` couldn't find the port. but `netstat` showed it was open. `-v` was the secret sauce I lacked. – Aaron McMillin Nov 29 '17 at 20:34
On macOS, here's an easy way to get the process ID that's listening on a specific port with netstat. This example looks for a process serving content on port 80:
find server running on port 80
netstat -anv | egrep -w [.]80.*LISTEN
sample output
tcp4 0 0 *.80 *.* LISTEN 131072 131072 715 0
The 2nd from the last column is the PID. In above, it's 715.
options
-a
- show all ports, including those used by servers
-n
- show numbers, don't look up names. This makes the command a lot faster
-v
- verbose output, to get the process IDs
-w
- search words. Otherwise the command will return info for ports 8000 and 8001, not just "80"
LISTEN
- give info only for ports in LISTEN mode, i.e. servers
![](../../users/profiles/143880.webp)
- 11,853
- 3
- 37
- 32
On the latest macOS version you can use this command:
lsof -nP -i4TCP:$PORT | grep LISTEN
If you find it hard to remember then maybe you should create a bash
function and export it with a friendlier name like so
vi ~/.bash_profile
and then add the following lines to that file and save it.
function listening_on() {
lsof -nP -i4TCP:"$1" | grep LISTEN
}
Now you can type listening_on 80
in your Terminal and see which process is listening on port 80
.
![](../../users/profiles/435040.webp)
- 8,811
- 4
- 28
- 31
On Snow Leopard (OS X 10.6.8), running 'man lsof' yields:
lsof -i 4 -a
(actual manual entry is 'lsof -i 4 -a -p 1234')
The previous answers didn't work on Snow Leopard, but I was trying to use 'netstat -nlp' until I saw the use of 'lsof' in the answer by pts.
![](../../users/profiles/2386108.webp)
- 347
- 2
- 5
I am a Linux guy. In Linux it is extremely easy with netstat -ltpn
or any combination of those letters. But in Mac OS X netstat -an | grep LISTEN
is the most humane. Others are very ugly and very difficult to remember when troubleshooting.
-
2The question explicitly asked for a specific TCP port, and your commands show listeners on all ports. – pts Aug 17 '16 at 20:04
lsof -n -i | awk '{ print $1,$9; }' | sort -u
This displays who's doing what. Remove -n to see hostnames (a bit slower).
![](../../users/profiles/1263999.webp)
- 664
- 7
- 11
-
1Your answer is not bad, but it's on a question with several highly-upvoted answers, and an accepted one, from multiple years ago. In the future, try to focus on more recent questions, especially ones that have not yet been answered. – May 03 '14 at 09:54
-
Does this command display non-TCP ports as well, and non-listeners as well? The question explicitly asks for listeners on TCP ports only. – pts May 04 '14 at 20:59
-
As per lsof(8) man page: `If no address is specified, this option [-i] selects the listing of all Internet and x.25 (HP-UX) network files.` – Misha Tavkhelidze May 05 '14 at 10:23
-
@Misha Tavkhelidze: So it displays non-listeners as well, so it doesn't answer the question. – pts Jan 07 '16 at 17:40
-
-
that shows not only ports being listened to, but also outbound connections? – Motti Shneor May 18 '16 at 04:34
I made a small script to see not only who is listening where but also to display established connections and to which countries. Works on OSX Siera
#!/bin/bash
printf "\nchecking established connections\n\n"
for i in $(sudo lsof -i -n -P | grep TCP | grep ESTABLISHED | grep -v IPv6 |
grep -v 127.0.0.1 | cut -d ">" -f2 | cut -d " " -f1 | cut -d ":" -f1); do
printf "$i : " & curl freegeoip.net/xml/$i -s -S | grep CountryName |
cut -d ">" -f2 | cut -d"<" -f1
done
printf "\ndisplaying listening ports\n\n"
sudo lsof -i -n -P | grep TCP | grep LISTEN | cut -d " " -f 1,32-35
#EOF
Sample output
checking established connections
107.178.244.155 : United States
17.188.136.186 : United States
17.252.76.19 : United States
17.252.76.19 : United States
17.188.136.186 : United States
5.45.62.118 : Netherlands
40.101.42.66 : Ireland
151.101.1.69 : United States
173.194.69.188 : United States
104.25.170.11 : United States
5.45.62.49 : Netherlands
198.252.206.25 : United States
151.101.1.69 : United States
34.198.53.220 : United States
198.252.206.25 : United States
151.101.129.69 : United States
91.225.248.133 : Ireland
216.58.212.234 : United States
displaying listening ports
mysqld TCP *:3306 (LISTEN)
com.avast TCP 127.0.0.1:12080 (LISTEN)
com.avast TCP [::1]:12080 (LISTEN)
com.avast TCP 127.0.0.1:12110 (LISTEN)
com.avast TCP [::1]:12110 (LISTEN)
com.avast TCP 127.0.0.1:12143 (LISTEN)
com.avast TCP [::1]:12143 (LISTEN)
com.avast TCP 127.0.0.1:12995 (LISTEN)
com.avast [::1]:12995 (LISTEN)
com.avast 127.0.0.1:12993 (LISTEN)
com.avast [::1]:12993 (LISTEN)
Google TCP 127.0.0.1:34013 (LISTEN)
This may be useful to check if you are connected to north-korea! ;-)
![](../../users/profiles/5996526.webp)
- 39
- 4
-
Great! Just update it to ipstack (because freegeoip does not exist anymore) and use jp instead of grep for easier parsing of json. – Robert Wildling Dec 30 '20 at 14:01
For macOS I use two commands together to show information about the processes listening on the machine and process connecting to remote servers. In other words, to check the listening ports and the current (TCP) connections on a host you could use the two following commands together
1. netstat -p tcp -p udp
2. lsof -n -i4TCP -i4UDP
Thought I would add my input, hopefully it can end up helping someone.
![](../../users/profiles/7478708.webp)
- 302
- 5
- 13
This is a good way on macOS High Sierra:
netstat -an |grep -i listen
![](../../users/profiles/1068010.webp)
- 594
- 4
- 12
-
That's quite right! The accepted answer actually is the right way ... netstat on mac os x doesn't show the pid to port mapping. – tr4nc3 Jan 09 '19 at 15:09