It’s quite common that in linux world, we are used to the netstat command to list the processes and the ports on which they are listening. We do expect the same to work in Mac OS but there are subtle differences in the commands used in Mac OS.
The main difference is the usage of -p parameter. In Mac OS world, it stands for protocol and not port or process id. And another difference is the filtering of the tcp connections using the flag -ptcp which stands for protocol tcp. There isn’t a nice way to get the process name using this command. But we can get all the listening ports using below commands:
netstat -an -ptcp // shows all active tcp connectionsnetstat -an -ptcp | grep LISTEN // shows all active connections filtered by only LISTENING portsnetstat -an -ptcp | grep <port number> // shows the connection that is actively listing on a given port
Another way to get all the listening process and ports is using the lsof(list of open files) command. Since a tcp socket is just like any other file descriptor in Unix based systems, we can use the below commands to find the required information
lsof -i -P // shows a list of file descriptors for the connections from/to an ip address and the process names. The second column shows the PID (process id)lsof -i -P | grep LISTEN // filter for all listening process. . The second column shows the PID (process id)
And in case you want to see all file descriptors used by a specific process. use
lsof -p <pid> // use the pid obtained above.And mostly above commands will list only the process owned by current user. Do not forget to use sudo to list all processes currently in use by any user!
