{"id":1266,"date":"2016-01-12T22:36:36","date_gmt":"2016-01-12T10:36:36","guid":{"rendered":"http:\/\/www.funk.co.nz\/blog\/?p=1266"},"modified":"2020-03-02T13:59:21","modified_gmt":"2020-03-02T01:59:21","slug":"netstat-mac-os","status":"publish","type":"post","link":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os","title":{"rendered":"netstat macos Show Listening Ports TCP Sockets with Grep"},"content":{"rendered":"<p>Show only servers - that is ports that are listening waiting for an inbound connection:<\/p>\n<p><strong style=\"font-size: 20px;\"><span style=\"font-family: 'courier new', courier, monospace;\">netstat -Waltn | grep LISTEN<\/span><\/strong><\/p>\n<h2>Show Server Port and Process ID in Netstat Mac<\/h2>\n<p>Instead of netstat you need to use LSOF (lists open files and sockets), piped into grep which will only shows lines with LISTEN in them:<\/p>\n<p><strong>sudo lsof -Pnl +M -i | grep LISTEN<\/strong><\/p>\n<p>Use -i4 for ip4 and -i6 for ip6. -i seems to work for all internet traffic. Handy for tracking down what program is running a server on your machine.<\/p>\n<h2>About Netstat<\/h2>\n<p>If you're looking to list open network ports the Mac equivalent to the linux command\u00c2\u00a0<em><strong>netstat -Walntpc<\/strong><\/em> might be what you're after. You are not alone, I get about 6,000 unique visitors per year here! Realtime list of all open connections and listening sockets: <em><strong>watch netstat -Walnt<\/strong><\/em> (No DNS much faster) watch <em><strong>netstat -Walt<\/strong><\/em> (with DNS lookups) The beauty of this command is that it gets you past that over long list of (non-internet surely?) unix sockets and kexts, why Apple put this into netstat I have no idea, perhaps the blame is with Darwin BSD kernel. But it should be more like Linux netstat in my opinion! That's because I can even see the process names and get continuous updates my adding <strong>pc<\/strong> with<\/p>\n<h2>Pipe netstat Into Grep To Remove Junk From The End<\/h2>\n<p>Listening socket \/ server processes ports macOS <strong>quickly<\/strong>: <span style=\"font-size: 20px;\"><strong><span style=\"font-family: 'courier new', courier, monospace;\">netstat -Waltn | grep tcp<\/span><\/strong><\/span> Every internet port fast with no DNS lookups: <span style=\"font-size: 20px;\"><strong><span style=\"font-family: 'courier new', courier, monospace;\">netstat -Waltn | grep -E \"(tcp|udp)(4|6)\"<\/span><\/strong><\/span> Like above but with DNS lookups but takes literally forever up to minutes: <span style=\"font-size: 20px;\"><strong><span style=\"font-family: 'courier new', courier, monospace;\">netstat -Walt | grep -E \"(tcp|udp)(4|6)\"<\/span><\/strong><\/span>\u00c2\u00a0<\/p>\n<h3>The Little Snitch Command - Who's phoning home?<\/h3>\n<p>How to use LSOF to discover <span style=\"text-decoration: underline;\">which app or process is listening to which ports:<\/span> <span style=\"font-size: 20px;\"><strong><span style=\"font-family: 'courier new', courier, monospace;\">lsof -Pnl +M -i -cmd | grep -E \"LISTEN|TCP|UDP\" <\/span><\/strong><\/span> I prefer to use <strong>-n<\/strong> to speed up the listing of netstat results by turning off DNS lookups ip to name resolution. The l is used to also show ipv6. To <strong>show all internet connections<\/strong>, whether ipv4 or ipv6, tcp or udp, listening, connected or closing - the lot: <strong>netstat -Waltn | grep p[46]<\/strong> Show only TCP connections: <strong>netstat -anp tcp<\/strong> To see which apps have listening sockets open: <strong><span style=\"font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; line-height: 1.5;\">sudo lsof \u00c2\u00a0-n -P | grep LISTEN<\/span><\/strong> Some other good linux ones here:\u00c2\u00a0<a href=\"http:\/\/www.commandlinefu.com\/commands\/matching\/netstat\/bmV0c3RhdA==\/sort-by-votes\">http:\/\/www.commandlinefu.com\/commands\/matching\/netstat\/bmV0c3RhdA==\/sort-by-votes<\/a><\/p>\n<p>&nbsp;<\/p>\n<h2>Linux Equivalent<\/h2>\n<p>This one is good for checking ssh tunnels: <strong>sudo netstat -tulpn<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Show only servers &#8211; that is ports that are listening waiting for an inbound connection: netstat -Waltn | grep LISTEN Show Server Port and Process ID in Netstat Mac Instead of netstat you need to use LSOF (lists open files and sockets), piped into grep which will only shows lines with LISTEN in them: sudo [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,28],"tags":[],"class_list":["post-1266","post","type-post","status-publish","format-standard","hentry","category-things-related-to-mac-os","category-unix"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>netstat macos Show Listening Ports TCP Sockets with Grep - The Funk Blog<\/title>\n<meta name=\"description\" content=\"show listening processes ports macOS quickly:netstat -Waltn | grep tcp\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"netstat macos Show Listening Ports TCP Sockets with Grep - The Funk Blog\" \/>\n<meta property=\"og:description\" content=\"show listening processes ports macOS quickly:netstat -Waltn | grep tcp\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os\" \/>\n<meta property=\"og:site_name\" content=\"The Funk Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-01-12T10:36:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-03-02T01:59:21+00:00\" \/>\n<meta name=\"author\" content=\"tomachi\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"tomachi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os\"},\"author\":{\"name\":\"tomachi\",\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/#\\\/schema\\\/person\\\/5e3b3851d9a5cbe644e6ccf190ea10f9\"},\"headline\":\"netstat macos Show Listening Ports TCP Sockets with Grep\",\"datePublished\":\"2016-01-12T10:36:36+00:00\",\"dateModified\":\"2020-03-02T01:59:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os\"},\"wordCount\":420,\"articleSection\":[\"Mac\",\"Unix\"],\"inLanguage\":\"en-NZ\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os\",\"url\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os\",\"name\":\"netstat macos Show Listening Ports TCP Sockets with Grep - The Funk Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/#website\"},\"datePublished\":\"2016-01-12T10:36:36+00:00\",\"dateModified\":\"2020-03-02T01:59:21+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/#\\\/schema\\\/person\\\/5e3b3851d9a5cbe644e6ccf190ea10f9\"},\"description\":\"show listening processes ports macOS quickly:netstat -Waltn | grep tcp\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os#breadcrumb\"},\"inLanguage\":\"en-NZ\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/technology\\\/things-related-to-mac-os\\\/netstat-mac-os#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"netstat macos Show Listening Ports TCP Sockets with Grep\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/\",\"name\":\"The Funk Blog\",\"description\":\"The profound rantings of the one like Tom Atkinson... and now art gallery and shop.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-NZ\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/#\\\/schema\\\/person\\\/5e3b3851d9a5cbe644e6ccf190ea10f9\",\"name\":\"tomachi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-NZ\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f3852adc4752b8dbdeb5e53ef14d50b7e30d76f3284b8f527c59e1d3efe5b170?s=96&d=monsterid&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f3852adc4752b8dbdeb5e53ef14d50b7e30d76f3284b8f527c59e1d3efe5b170?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f3852adc4752b8dbdeb5e53ef14d50b7e30d76f3284b8f527c59e1d3efe5b170?s=96&d=monsterid&r=g\",\"caption\":\"tomachi\"},\"description\":\"Tomachi - drummer, composer, digital media and online marketing guru.\",\"sameAs\":[\"http:\\\/\\\/www.funk.co.nz\\\/\",\"https:\\\/\\\/x.com\\\/tomachi\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/tomachinz\\\/\",\"tomachi\"],\"url\":\"https:\\\/\\\/www.funk.co.nz\\\/blog\\\/author\\\/tomachi\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"netstat macos Show Listening Ports TCP Sockets with Grep - The Funk Blog","description":"show listening processes ports macOS quickly:netstat -Waltn | grep tcp","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os","og_locale":"en_US","og_type":"article","og_title":"netstat macos Show Listening Ports TCP Sockets with Grep - The Funk Blog","og_description":"show listening processes ports macOS quickly:netstat -Waltn | grep tcp","og_url":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os","og_site_name":"The Funk Blog","article_published_time":"2016-01-12T10:36:36+00:00","article_modified_time":"2020-03-02T01:59:21+00:00","author":"tomachi","twitter_misc":{"Written by":"tomachi","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os#article","isPartOf":{"@id":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os"},"author":{"name":"tomachi","@id":"https:\/\/www.funk.co.nz\/blog\/#\/schema\/person\/5e3b3851d9a5cbe644e6ccf190ea10f9"},"headline":"netstat macos Show Listening Ports TCP Sockets with Grep","datePublished":"2016-01-12T10:36:36+00:00","dateModified":"2020-03-02T01:59:21+00:00","mainEntityOfPage":{"@id":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os"},"wordCount":420,"articleSection":["Mac","Unix"],"inLanguage":"en-NZ"},{"@type":"WebPage","@id":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os","url":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os","name":"netstat macos Show Listening Ports TCP Sockets with Grep - The Funk Blog","isPartOf":{"@id":"https:\/\/www.funk.co.nz\/blog\/#website"},"datePublished":"2016-01-12T10:36:36+00:00","dateModified":"2020-03-02T01:59:21+00:00","author":{"@id":"https:\/\/www.funk.co.nz\/blog\/#\/schema\/person\/5e3b3851d9a5cbe644e6ccf190ea10f9"},"description":"show listening processes ports macOS quickly:netstat -Waltn | grep tcp","breadcrumb":{"@id":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os#breadcrumb"},"inLanguage":"en-NZ","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.funk.co.nz\/blog\/technology\/things-related-to-mac-os\/netstat-mac-os#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.funk.co.nz\/blog"},{"@type":"ListItem","position":2,"name":"netstat macos Show Listening Ports TCP Sockets with Grep"}]},{"@type":"WebSite","@id":"https:\/\/www.funk.co.nz\/blog\/#website","url":"https:\/\/www.funk.co.nz\/blog\/","name":"The Funk Blog","description":"The profound rantings of the one like Tom Atkinson... and now art gallery and shop.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.funk.co.nz\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-NZ"},{"@type":"Person","@id":"https:\/\/www.funk.co.nz\/blog\/#\/schema\/person\/5e3b3851d9a5cbe644e6ccf190ea10f9","name":"tomachi","image":{"@type":"ImageObject","inLanguage":"en-NZ","@id":"https:\/\/secure.gravatar.com\/avatar\/f3852adc4752b8dbdeb5e53ef14d50b7e30d76f3284b8f527c59e1d3efe5b170?s=96&d=monsterid&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f3852adc4752b8dbdeb5e53ef14d50b7e30d76f3284b8f527c59e1d3efe5b170?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f3852adc4752b8dbdeb5e53ef14d50b7e30d76f3284b8f527c59e1d3efe5b170?s=96&d=monsterid&r=g","caption":"tomachi"},"description":"Tomachi - drummer, composer, digital media and online marketing guru.","sameAs":["http:\/\/www.funk.co.nz\/","https:\/\/x.com\/tomachi","https:\/\/www.youtube.com\/user\/tomachinz\/","tomachi"],"url":"https:\/\/www.funk.co.nz\/blog\/author\/tomachi"}]}},"_links":{"self":[{"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/posts\/1266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/comments?post=1266"}],"version-history":[{"count":0,"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/posts\/1266\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/media?parent=1266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/categories?post=1266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.funk.co.nz\/blog\/wp-json\/wp\/v2\/tags?post=1266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}