I'm looking for a simple command that will list ALL currently active and/or otherwise bound TCP & UDP sockets, corresponding port numbers and their respective states (i.e. ESTABLISHED, LISTEN, WAIT, etc.)

Sort of like a reverse nmap scan is what I'm going for here.


From netstat's manual page:

The netstat command symbolically displays the contents of various network-related data structures. There are a number of output formats, depending on the options for the information presented. The first form of the command displays a list of active sockets for each protocol.

pse@Mithos:~$ netstat
Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)    
tcp4       0      0  localhost.8228         localhost.52662        ESTABLISHED
tcp4       0      0  localhost.52662        localhost.8228         ESTABLISHED
tcp4       0      0     stackoverflow.co.https ESTABLISHED
tcp4       0      0  localhost.8228         localhost.52656        ESTABLISHED
tcp4       0      0  localhost.52656        localhost.8228         ESTABLISHED
tcp4       0      0  localhost.8228         localhost.52651        ESTABLISHED
  • This gives syntax error near unexpected token ('` – clankill3r Jan 23 '19 at 16:08
  • @clankill3r how are you calling netstat? – nohillside Jan 23 '19 at 16:10
  • man netstat(1) – clankill3r Jan 24 '19 at 13:17
  • @clankill3r Try man netstat for the manual page, netstat for the command itself. – nohillside Jan 24 '19 at 13:26

Another way to do it is to use lsof benefiting it shows the process that owns the sockets. Either combined with grep:

sudo lsof -n -i | grep -e LISTEN -e ESTABLISHED

(just use -e WAIT accordingly if you need it specifically), or with its own filtering based on TCP socket states:

sudo lsof -n -i -s TCP:LISTEN,ESTABLISHED

I know certain versions of netstat show process with the -b switch, but not the OSX/BSD one apparently...

  • 1
    You need to run this as root (i.e. use sudo) to see other users' processes. Also, you can skip the grep by telling lsof you only want sockets in those states: sudo lsof -niTCP -sTCP:LISTEN,ESTABLISHED – Gordon Davisson Nov 26 '16 at 5:54
  • Yeah sorry. Root access is required to see all ports. Good catch! – Chris Gleason Dec 15 '16 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .