251

I would like to list my open network ports in Terminal with built in commands. As what I know, netstat is the command to use. But I'm struggling to get any useful information out of it.

How can I list my open ports with netstat? Any specific flags that helps me in this case?

370

netstat -anvp tcp | awk 'NR<3 || /LISTEN/'

Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)     rhiwat shiwat    pid   epid  state    options
tcp46      0      0  *.62981                *.*                    LISTEN      131072 131072  34548      0 0x0100 0x00000006
…

sudo lsof -PiTCP -sTCP:LISTEN

COMMAND     PID      USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
BetterTou 34548 grgarside   20u  IPv4 0xa42a1d0ade5d3585      0t0  TCP *:62981 (LISTEN)
BetterTou 34548 grgarside   21u  IPv6 0xa42a1d0ad67f7a5d      0t0  TCP *:62981 (LISTEN)
…
| improve this answer | |
84

maybe you can use lsof:

lsof -Pn -i4

-i4 means only show ipv4 address and ports -P and -n fast output

output like this

➜  lsof -Pn -i4 | grep LISTEN
QQPlatfor 22767 xxxx   15u  IPv4 0x36c2bfa04e49385d      0t0  TCP *:49969 (LISTEN)
GoAgentX  33377 xxxx    4u  IPv4 0x36c2bfa06e68b12d      0t0  TCP *:56154 (LISTEN)
GoAgentX  33377 xxxx   20u  IPv4 0x36c2bfa04e492f8d      0t0  TCP 127.0.0.1:56155 (LISTEN)
| improve this answer | |
  • 3
    lsof lists open files. Network sockets count as files, so each open network socket (either listening or actively in use) will be listed in lsof. – Craig Trader Dec 11 '15 at 9:53
11

First, I'm not a BSD expert, but like the OP I wanted the rough equivalent of running the following on a *nix box, or something close:

netstat -tulpn

I read other questions/answers offering lsof* and netstat* on MacOS, and I still wanted something with more compact output. So, this is what I quick put together:

netstat -Watnlv | grep LISTEN | awk '{"ps -o comm= -p " $9 | getline procname;colred="\033[01;31m";colclr="\033[0m"; print cred "proto: " colclr $1 colred " | addr.port: " colclr $4 colred " | pid: " colclr $9 colred " | name: " colclr procname;  }' | column -t -s "|"

It's a bit overkill, so I added color to the output for good measure. Since I'm not going to be able to remember, or want to type, this behemoth. I put it in a bash function and then just call that when needed. Here is said bash function:

macnst (){
    netstat -Watnlv | grep LISTEN | awk '{"ps -o comm= -p " $9 | getline procname;colred="\033[01;31m";colclr="\033[0m"; print colred "proto: " colclr $1 colred " | addr.port: " colclr $4 colred " | pid: " colclr $9 colred " | name: " colclr procname;  }' | column -t -s "|"
}

I have a small collection of these convenience functions in a file that I source from ~/.bash_profile, or ~/.zshrc. This is being added to the collection. It'd be interesting to see other opportunities to make this nicer/slimmer.

Sample Output:

> macns
proto: tcp4     addr.port: 127.0.0.1.9999     pid: 70078    name:  /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46    addr.port: *.35729            pid: 70078    name:  /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46    addr.port: *.62087            pid: 70078    name:  /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46    addr.port: *.62070            pid: 70078    name:  /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp46    addr.port: *.62085            pid: 70078    name:  /Library/Java/JavaVirtualMachines/jdk1.8.0_162.jdk/Contents/Home/bin/java
proto: tcp4     addr.port: *.61993            pid: 70043    name:  /Applications/IntelliJ IDEA.app/Contents/MacOS/idea
proto: tcp46    addr.port: *.61992            pid: 70065    name:  /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4     addr.port: 127.0.0.1.42329    pid: 70065    name:  /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4     addr.port: 127.0.0.1.61983    pid: 70043    name:  /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4     addr.port: 127.0.0.1.63342    pid: 70043    name:  /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4     addr.port: 127.0.0.1.6942     pid: 70043    name:  /Applications/IntelliJ IDEA.app/Contents/jdk/Contents/Home/jre/bin/java
proto: tcp4     addr.port: 127.0.0.1.3075     pid: 67931    name:  /Applications/electerm.app/Contents/Frameworks/electerm Helper.app/Contents/MacOS/electerm Helper
proto: tcp6     addr.port: *.58640            pid: 320      name:  /usr/libexec/rapportd
proto: tcp4     addr.port: *.58640            pid: 320      name:  /usr/libexec/rapportd
proto: tcp4     addr.port: 127.0.0.1.9770     pid: 71       name:  /Applications/Pritunl.app/Contents/Resources/pritunl-service
| improve this answer | |
9

The simplest method is to use netstat:

$ netstat -ap tcp
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)    
tcp4       0      0  10.0.2.23.58792        17.172.233.109.5223    ESTABLISHED
tcp4      87      0  my_iMac__at_home.55481 stackoverflow.co.http  ESTABLISHED
tcp4     116      0  my_iMac__at_home.55478 stackoverflow.co.http  ESTABLISHED
tcp4      58      0  my_iMac__at_home.63452 stackoverflow.co.http  ESTABLISHED
tcp4      87      0  my_iMac__at_home.63429 stackoverflow.co.http  ESTABLISHED
tcp4       0      0  localhost.63173        localhost.773          ESTABLISHED
tcp4       0      0  localhost.773          localhost.63173        ESTABLISHED
tcp4       0      0  localhost.63173        *.*                    LISTEN     
tcp4       0      0  localhost.63172        *.*                    LISTEN     
tcp4       0      0  localhost.ipp          *.*                    LISTEN     
tcp6       0      0  localhost.ipp          *.*                    LISTEN     

…without any added filtering, so as to get the correct headers, and to see both servers listening, and connections already established in both directions. In this example, the 1st line exhibits a connexion from my Mac toward 17.172.233.109, which a further:

whois 17.172.233.109

taught me it is located at Apple.

| improve this answer | |
  • 1
    This answer is identical to the already accepted answer – Christopher Hunter May 14 at 23:22
  • If you don't get the key difference just try it on a real case of attack and you will see which one is best for your defense. – dan May 17 at 12:18
  • I understand the key difference, which is the accepted answer filters for listen ports only, and that is a better answer for this question "how can I list my open ports?" Looking at all connections has value in other cases (like an attack) but that is not what's being discussed here. – Christopher Hunter May 19 at 17:46
  • Do you see one port which isn't opened in the output of the netstat I gave here? – dan May 19 at 20:50
  • netstat output is going to vary significantly. For example, I ran your version right now and it does show all of the listen ports, but also around 100 ESTABLISHED connections. So if my goal is to list my open ports, filtering out everything else is simply a better solution. – Christopher Hunter May 19 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .