Join the Stack Overflow Community
Stack Overflow is a community of 6.6 million programmers, just like you, helping each other.
Join them; it only takes a minute:
Sign up

On Linux, I can use netstat -pntl | grep $PORT or fuser -n tcp $PORT to find out which process (PID) is listening on the specified TCP port. How do I get the same information on Mac OS X?

share|improve this question
6  
netstat -p tcp | grep $PORT. I think this out of topic here. – khachik Dec 12 '10 at 12:34
13  
Sorry, netstat -p tcp | grep $PORT doesn't display PIDs since netstat on the Mac OS X cannot display PIDs. – pts Dec 12 '10 at 12:39
up vote 846 down vote accepted

Depending on your version of Mac OS X, use one of these:

lsof -n -i4TCP:$PORT | grep LISTEN
lsof -n -iTCP:$PORT | grep LISTEN
lsof -n -i:$PORT | grep LISTEN

Substitute $PORT with the port number or a comma-separated list of port numbers.

Prepend sudo (followed by a space) if you need information on ports below #1024.

The -n flag is for displaying IP addresses instead of host names. This makes the command execute much faster, because DNS lookups to get the host names can be slow (several seconds or a minute for many hosts).

See the comments for more options.

share|improve this answer
76  
Prefix this with sudo to see processes you don't own. – Gordon Davisson Dec 12 '10 at 16:23
22  
on lion, worked with a change sudo lsof -i TCP:$PORT | grep LISTEN – dhaval Aug 17 '12 at 8:28
2  
awesome thing, saved me time! thanks a lot – daydreamer Sep 24 '12 at 23:53
44  
On Mountain Lion, you don't need grep: sudo lsof -iTCP:$PORT -sTCP:LISTEN – Siu Ching Pong -Asuka Kenji- Jul 12 '13 at 20:54
11  
after so many searches this one is the best. people who directly want to copy the command should replace $PORT with actual port number or define the variable PORT and that too for multiple ports like: export PORT=8080,4433; lsof -n -i4TCP:$PORT – siddhusingh Mar 2 '14 at 12:06

You can also use:

sudo lsof -i -n -P | grep TCP

This works in Mavericks.

share|improve this answer
1  
This did the job for me, cheers (OS X 10.9) – James Cushing Jan 30 '14 at 9:22
5  
Also works on Yosemite (10.10) – Galuga Nov 19 '14 at 5:49
1  
The -i option makes it significantly faster. 0.02 seconds vs 2 seconds. In my application this made quite the difference. – Eric Boehs Dec 20 '14 at 3:04
1  
this worked for me on Yosemite 10.10.2 – Moeen M Mar 31 '15 at 10:10
2  
Great! Works with El Capitan... – doncadavona Feb 6 '16 at 0:45

For Yosemite (10.10) and El Capitan (10.11) and macOS Sierra (10.12):

sudo lsof -iTCP -sTCP:LISTEN -n -P
share|improve this answer
1  
It works on at least as old as Snow Leopard. – Yongwei Wu Aug 2 '16 at 12:10
    
For some reason I accidentally downvoted this excellent answer, and my vote is now locked since it's more than 4 hours ago. Sorry. – Jonas Lomholdt Nov 16 '16 at 14:29

Update January 2016

Really surprised no-one has suggested:

lsof -i :PORT_NUMBER

to get the basic information required. For instance, checking on port 1337:

lsof -i :1337

Other variations, depending on circumstances:

sudo lsof -i :1337
lsof -i tcp:1337

You can easily build on this to extract the PID itself. For example:

lsof -t -i :1337

which is also equivalent (in result) to this command:

lsof -i :1337 | awk '{ print $2; }' | head -n 2 | grep -v PID

Quick illustration:

enter image description here

For completeness, because frequently used together:

To kill the PID:

kill -9 <PID>
# kill -9 60401

or as a one liner:

kill -9 $(lsof -t -i :1337)
share|improve this answer
1  
This command also displays non-listener PIDs, and the questions explicitly asked for listeners only. – pts Jan 7 '16 at 17:41
1  
You can also run lsof -t -i :1338. -t will return the process id, so you won't have to awk/head. – KFunk Aug 19 '16 at 21:10
    
@KFunk - Updated, thanks. – arcseldon Aug 20 '16 at 18:01
    
Nothing worked except kill -9 $(lsof -t -i :5000) on el capitan – goksel Sep 28 '16 at 22:14
    
@goksel - pleased to hear it! – arcseldon Oct 4 '16 at 14:29

This works in Mavericks (OSX 10.9.2).

sudo lsof -nP -iTCP:$PORT -sTCP:LISTEN
share|improve this answer
    
I didn't need sudo on 10.10. – Sophistifunk Feb 19 '15 at 11:24
    
Also works on Fedora 12. – Meetai.com Mar 8 '15 at 12:41
    
Worked Yosemite (10.10.2) – Phillip Kamikaze Jun 24 '15 at 15:16
    
needed sudo and worked well – vikramvi Sep 29 '16 at 10:39

on OS X you can use the -v option for netstat to give the associated pid.

type:

netstat -anv | grep [.]PORT

the output will look like this:

tcp46      0      0  *.8080                 *.*                    LISTEN      131072 131072   3105      0

The PID is the number before the last column, 3105 for this case

share|improve this answer
    
You also need to add grep LISTEN to show the listeners only. – pts Jan 7 '16 at 17:40

On Snow Leopard (OS X 10.6.8), running 'man lsof' yields:

lsof -i 4 -a

(actual manual entry is 'lsof -i 4 -a -p 1234')

The previous answers didn't work on Snow Leopard, but I was trying to use 'netstat -nlp' until I saw the use of 'lsof' in the answer by pts.

share|improve this answer
lsof -n -i | awk '{ print $1,$9; }' | sort -u

This displays who's doing what. Remove -n to see hostnames (a bit slower).

share|improve this answer
1  
Your answer is not bad, but it's on a question with several highly-upvoted answers, and an accepted one, from multiple years ago. In the future, try to focus on more recent questions, especially ones that have not yet been answered. – Esa Lakaniemi May 3 '14 at 9:54
    
Does this command display non-TCP ports as well, and non-listeners as well? The question explicitly asks for listeners on TCP ports only. – pts May 4 '14 at 20:59
    
As per lsof(8) man page: If no address is specified, this option [-i] selects the listing of all Internet and x.25 (HP-UX) network files. – Misha Tavkhelidze May 5 '14 at 10:23
    
@Misha Tavkhelidze: So it displays non-listeners as well, so it doesn't answer the question. – pts Jan 7 '16 at 17:40
    
Add -sTCP:LISTEN to lsof – Misha Tavkhelidze Jan 11 '16 at 10:34

I am a Linux guy. In Linux it is extremely easy with netstat -ltpn or any combination of those letters. But in Mac OS X netstat -an | grep LISTEN is the most humane. Others are very ugly and very difficult to remember when troubleshooting.

share|improve this answer
1  
The question explicitly asked for a specific TCP port, and your commands show listeners on all ports. – pts Aug 17 '16 at 20:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.