48

I am trying to get all the processes listening for a network connection on Mac OS X. netstat does not have the -p option and I am trying with lsof

lsof -i -sTCP:LISTEN

gives me a fair list of listening processes but not all. I can for example telnet to port 10080 where I have a process listening for a connection but this is not shown in the output of lsof. What am I missing?

$ telnet localhost 10080
Trying ::1...
Connected to localhost.
Escape character is '^]'.
^]
telnet> Connection closed.

but

$ sudo lsof -n -i | grep 10080
$
  • 3
    Does the output of lsof say amanda instead of 10080? – Jon Lin Dec 15 '11 at 13:56
  • 3
    @JonLin I didn't notice that the -n only affects addresses and not ports. To get port numbers I have to use -P too. Thanks – Matteo Dec 15 '11 at 14:35
  • 3
    @JonLin: but you have post lsof -i -sTCP:LISTEN , and it without the -n and it didn't reveal the 10080 too. So you have to use the -P. – Hanan N. Dec 15 '11 at 17:30
71
sudo lsof -iTCP -sTCP:LISTEN
sudo lsof -iTCP -sTCP:LISTEN -P
sudo lsof -iTCP -sTCP:LISTEN -P -n
sudo lsof -iTCP -sTCP:LISTEN -n

All return the same 32 entries (... | wc -l) on my heavily used Lion MBP.

-P -n prevents lsof from doing name resolution, and it doesn't block. Missing either one of these, it can be very slow.

For UDP: sudo lsof -iUDP -P -n | egrep -v '(127|::1)'. Without -n and -P, it takes a long time.

Reminder: This does not include firewall settings.

  • 3
    Yes the problem was the missing -P. I wrongly assumed -n applied not only to IPs but port numbers too. – Matteo Dec 29 '11 at 7:04
-1
  1. First find out the Process Id (pid) which has occupied the required port (e.g 5434):

    ps aux | grep 5434
    
  2. Kill that process:

    kill -9 <pid>
    
  • 5
    ps aux does not list the ports a process is using – Matteo Jul 31 '15 at 12:12
  • I agree with Matteo; are you sure you didn't do something like netstat -anp | grep 5434 (which will return a list of stuff that is listening on 5434, and the first or second column is the pid?) – Foon Oct 8 '15 at 12:29
  • 6
    Thus could only work in a situation where a process was called with port number given explicitly in the execution string and that part of the string would be matched by grep. – techraf Mar 16 '16 at 1:01
  • 1
    Using kill -9 as a first option for getting rid of a process is an extreme choice. Also, this doesn't actually answer the question, which isn't about killing things, but finding out what's running. – lindes Dec 16 '17 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.