My friend is currently running the default firewall with "Block all incoming connection" (except the basic ones like 80). I just scanned his mac for open ports and I found the following:

 Open TCP Port:     3128        ndl-aas
 Open TCP Port:     8080        http-alt

Is it normal to have those ports open, or does he have something fuzzy installed?

  • How did you scan his mac? (I would like to scan mine.)
    – Drux
    Commented Jun 26, 2014 at 0:27
  • 1
    It's built in OSX. Search for it on google.
    – DevRandom
    Commented Jul 4, 2014 at 10:14

4 Answers 4


Neither of those ports is opened by the OS. You will want to run a command like sudo lsof|grep LISTEN to figure out what processes have opened those ports on the Mac.

See http://support.apple.com/kb/TS1629 for documented ports that Apple uses and note that neither are used other than 10.4 server and earlier where port 8080 was part of jboss as a stock component of server.


It's not normal to have ports open unless configured otherwise. You can find the names of the programs that are listening at these ports using the following command in Terminal (under /Applications/Utilities):

lsof -i :3128
lsof -i :8080

The first column of the output would be the program name.


Ports 3128 and 8080 are typically used by HTTP proxy software, such as squid (which uses port 3128 by default.)

Port 8080 is also often used by a local web server used for development or similar, typically because the root account is generally required to listen on port 80.

  • Yes - these are the exact sort of culprits to look for.
    – bmike
    Commented Oct 8, 2013 at 15:32

If this is OS X, it is quite possible the system has running virtual machine such as Parallels or VMWare running Windows. Windows runs bunch of open ports that are not used by OS X. Closing virtual machine should close those ports.

Check also (netstat -a -p tcp) if source (local) and destination (foreign) addresses do not include 'localhost' in the description. This would further indicate some local process running - in my case resulted by virtual machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .