Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

TCP port 5901 is open on my machine and is causing some mischief, and I want to know which process is opening it. When I run lsof -i -P I see that launchd is the process that opened the port.

Is there a quick way I can determine which launchd plist file is being used to open that port? I'd rather not have to go through each plist mentioned by launchctl list.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

First, is this being opened by the system launchd (process ID 1, running as root), or a user launchd (running as a user)? If it's the system launchd, you're looking for a LaunchDaemon; if it's a user launchd, you're looking for a LaunchAgent.

Assuming it's the system launchd, you can look for the relevant LaunchDaemon like this:

grep 5901 {,/System}/Library/LaunchDaemons/*

(note: if port 5901 were listed in /etc/services, you'd also have to look for it by name as well as number. But it isn't, so you don't have to worry about that.)

It's also possible that it's a LaunchDaemon that was loaded from some other place; tracking that down would be messy, so start with the easy check first.

share|improve this answer
    
Awesome grep there. Nice generalization on /etc/services as well. –  bmike Nov 22 '12 at 5:01
add comment

Port 5901 is used for VNC (Remote Desktop screen sharing on OS X) and by design launchd actually reads all of the configuration files that are loaded on your Mac and then listens on ports rather than starting the program that eventually will receive communications on that port.

In this case, since you only see launchd and not a screensharingd or ScreensharingAgent process you might just be able to conclude that launchd is listening as a proxy for another process that isn't running at present (or perhaps yet to run).

You can test this by disabling the screen sharing settings in System Preferences or uninstalling any other remote VNC server software you have and then re-examining lsof.

share|improve this answer
    
So we don't have any VNC software that I'm aware of installed on the computer. In addition, screen sharing and all remote management services have been disabled, yet the port is still open. I know some process is associated with that port because when I connect to it through netcat it crashes my machine. –  tifkin Nov 21 '12 at 15:43
    
Hmm - I can't think of another short cut other than the one you want to avoid - figuring out which plist is making launchd listen on 5901. I don't have any systems listening in on that port - so hopefully it's something innocent and not malware. –  bmike Nov 21 '12 at 16:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.