Sign up ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm looking for something that is a mix of tcpdump, lsof, and netstat.

I want to be able to filter like tcpdump, but have an additional column showing the process ID. At the end I'd like to be able to stats like wireshark, but by application.

Why, you ask?

Good question. I want to be able to answer things like this:

  • What process is connecting on port 80 to * (owned by google)
  • Why am I seeing packets to amazonaws when I have no browsers running?
  • Why is there traffic to when I have no web pages open to it?

GUI or commandline doesn't matter.

This got started when I was trying to figure what was taking up all the bandwidth on my rather limited connection. (We have 4 computers in the house for an asymetric 2M/500k connection. That's bits, not bytes.)

share|improve this question
Not a perfect match, but better than the individual ones above: nettop. Should be there out of the box on the Mac, or you can install it using Homebrew. Doesn't have the filtering, but it lists connections by process. – nwinkler Jan 27 '14 at 11:31
I'd also be interested in a good solution, preferrably something along the lines of Wireshark for Unix and Windows. Technically, wireshark claims to run in Mavericks via XQuartz, but I've never gotten it to install properly. – BringMyCakeBack Jan 31 '14 at 1:23
I wrote a simple script to search for the open connections. It has search by wildcard. Can it suit you? – Igor Hatarist Jan 31 '14 at 14:30

2 Answers 2

up vote 2 down vote accepted

lsof will do this with the correct flags and arguments. The following flags will show you the program and PID using the open connections.

-P to show you port numbers instead of names.

Here are examples for the 3 situations you listed.


Note, I do not believe that lsof allows globbing with *



lsof -Pi@x.x.x.x
share|improve this answer
Good answer. I'd also give credit for nettop, if it were an answer. I've often used lsof to find files. Didn't realize it was so versitile for networks too. – Sherwood Botsford Feb 2 '14 at 16:06

Have you tried writing a directory to your sdcard. Example. Directoryname_Read_write_exacute_system_port. The savvy can figure out the rest. Not for the lil league.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.