What is bound at port 53 of localhost and how to stop that service?

Question

I want to run my own bind dns forwarder but in order to bind it to port 53 of my machine I first need to stop what is running there.

It seems that a service called "domain" is running there from what I found:

$ nc -vz 127.0.0.1 53
found 0 associations
found 1 connections:
     1: flags=82<CONNECTED,PREFERRED>
    outif lo0
    src 127.0.0.1 port 52950
    dst 127.0.0.1 port 53
    rank info not available
    TCP aux info available

Connection to 127.0.0.1 port 53 [tcp/domain] succeeded!

What is that service and how can I stop it?

Answer 1

The command lsof -i TCP:53 will give the active sessions on port 53.

The command netstat -vanp tcp | grep 53 will give information on the processes that are listening on port 53. The 9th column gives you the process ID (PID).

To get from the PID to the program name you run: ps -p <PID>. Which will give you what application is running under this PID.

You can string these command together as

netstat -vanp tcp | grep 53 | awk '{print $9}' | xargs ps -p

As for killing the process, you can always run kill -9 <PID>. But I'd recommend finding out what program is running and why. It might be back up after a reboot.

A similar question was asked at Kill TCP connections on a Mac in Terminal .