I would like to list my open network ports in Terminal with built in commands. As what I know, netstat is the command to use. But I'm struggling to get any useful information out of it.
How can I list my open ports with netstat? Any specific flags that helps me in this case?
netstat -anvp tcp | awk 'NR<3 || /LISTEN/'
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state) rhiwat shiwat pid epid state options
tcp46 0 0 *.62981 *.* LISTEN 131072 131072 34548 0 0x0100 0x00000006
…
sudo lsof -PiTCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
BetterTou 34548 grgarside 20u IPv4 0xa42a1d0ade5d3585 0t0 TCP *:62981 (LISTEN)
BetterTou 34548 grgarside 21u IPv6 0xa42a1d0ad67f7a5d 0t0 TCP *:62981 (LISTEN)
…
maybe you can use lsof:
lsof -Pn -i4
-i4 means only show ipv4 address and ports -P and -n fast output
output like this
➜ lsof -Pn -i4 | grep LISTEN
QQPlatfor 22767 xxxx 15u IPv4 0x36c2bfa04e49385d 0t0 TCP *:49969 (LISTEN)
GoAgentX 33377 xxxx 4u IPv4 0x36c2bfa06e68b12d 0t0 TCP *:56154 (LISTEN)
GoAgentX 33377 xxxx 20u IPv4 0x36c2bfa04e492f8d 0t0 TCP 127.0.0.1:56155 (LISTEN)
First, I'm not a BSD expert, but like the OP I wanted the rough equivalent of running the following on a *nix box, or something close:
netstat -tulpn
I read other questions/answers offering lsof* and netstat* on MacOS, and I still wanted something with more compact output. So, this is what I quick put together:
netstat -Watnlv | grep LISTEN | awk '{"ps -o comm= -p " $9 | getline procname;colred="\033[01;31m";colclr="\033[0m"; print cred "proto: " colclr $1 colred " | addr.port: " colclr $4 colred " | pid: " colclr $9 colred " | name: " colclr procname; }' | column -t -s "|"
It's a bit overkill, so I added color to the output for good measure. Since I'm not going to be able to remember, or want to type, this behemoth. I put it in a bash function and then just call that when needed. Here is said bash function:
macnst (){
netstat -Watnlv | grep LISTEN | awk '{"ps -o comm= -p " $9 | getline procname;colred="\033[01;31m";colclr="\033[0m"; print colred "proto: " colclr $1 colred " | addr.port: " colclr $4 colred " | pid: " colclr $9 colred " | name: " colclr procname; }' | column -t -s "|"
}
I have a small collection of these convenience functions in a file that I source from ~/.bash_profile, or ~/.zshrc. This is being added to the collection. It'd be interesting to see other opportunities to make this nicer/slimmer.
Sample Output:
> macns
proto: tcp4 addr.port: 127.0.0.1.9999 pid: 70078 name: /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46 addr.port: *.35729 pid: 70078 name: /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46 addr.port: *.62087 pid: 70078 name: /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46 addr.port: *.62070 pid: 70078 name: /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46 addr.port: *.62085 pid: 70078 name: /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp4 addr.port: *.61993 pid: 70043 name: /Applications/IntelliJ IDEA.app/Contents/MacOS/idea
proto: tcp46 addr.port: *.61992 pid: 70065 name: /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4 addr.port: 127.0.0.1.42329 pid: 70065 name: /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4 addr.port: 127.0.0.1.61983 pid: 70043 name: /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4 addr.port: 127.0.0.1.63342 pid: 70043 name: /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4 addr.port: 127.0.0.1.6942 pid: 70043 name: /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4 addr.port: 127.0.0.1.3075 pid: 67931 name: /Applications/electerm.app/Contents/Frameworks/electerm Helper.app/Contents/MacOS/electerm Helper
proto: tcp6 addr.port: *.58640 pid: 320 name: /usr/libexec/rapportd
proto: tcp4 addr.port: *.58640 pid: 320 name: /usr/libexec/rapportd
proto: tcp4 addr.port: 127.0.0.1.9770 pid: 71 name: /Applications/Pritunl.app/Contents/Resources/pritunl-service
The simplest method is to use netstat:
$ netstat -ap tcp
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 10.0.2.23.58792 17.172.233.109.5223 ESTABLISHED
tcp4 87 0 my_iMac__at_home.55481 stackoverflow.co.http ESTABLISHED
tcp4 116 0 my_iMac__at_home.55478 stackoverflow.co.http ESTABLISHED
tcp4 58 0 my_iMac__at_home.63452 stackoverflow.co.http ESTABLISHED
tcp4 87 0 my_iMac__at_home.63429 stackoverflow.co.http ESTABLISHED
tcp4 0 0 localhost.63173 localhost.773 ESTABLISHED
tcp4 0 0 localhost.773 localhost.63173 ESTABLISHED
tcp4 0 0 localhost.63173 *.* LISTEN
tcp4 0 0 localhost.63172 *.* LISTEN
tcp4 0 0 localhost.ipp *.* LISTEN
tcp6 0 0 localhost.ipp *.* LISTEN
…without any added filtering, so as to get the correct headers, and
to see both servers listening, and connections already established in both directions.
In this example, the 1st line exhibits a connexion from my Mac toward
17.172.233.109, which a further:
whois 17.172.233.109
taught me it is located at Apple.
Based on @kroolk's great answer, I would suggest this one-liner:
netstat -Watnlv | grep LISTEN | awk '{"ps -ww -o args= -p " $9 | getline procname;colred="\033[01;31m";colclr="\033[0m"; print colred "proto: " colclr $1 colred " | addr.port: " colclr $4 colred " | pid: " colclr $9 colred " | name: " colclr procname; }' | column -t -s "|"
...which will not truncate the output of ps (at least on my mac) and give the full command including arguments :-)
As an alternative tool, you can try BSD look alike sockstat tool to show LISTENING sockets: https://github.com/mezantrop/sockstat
To expand on @grg's answer, here is a command that will give a succinct list of used TCP ports:
sudo lsof -PiTCP -sTCP:LISTEN | awk -F ":" '{ print $2 }' | awk -F " " '{ print $1 }' | sort -g | uniq
