How to analyze open ports on localhost and why they are open?

Question

I thought I left an express server open on localhost so I ran a Rustscan port scanner and got these result,

Open [::1]:5000
Open [::1]:5432
Open [::1]:7000
Open [::1]:55743

For 5000 I noticed has always been open ever since I updated to macOS Monterey, for 55743 I assume is open because I am in a zoom call for class but not sure about the other two, 7000 and 5432. (7000, 5432 are not from any of my local development servers unless process.env.PORT is set to them which I doubt)

I did some research and can’t select any tool out there I can download to relieve worries of malicious software operating on these ports.

Also when I go to localhost:7000, 5432 I get http error 403 access denied.

Is there a way I could analyze these ports with more depth to see why my computer has them open?

Answer 1

PortsMonitor is my favourite GUI tool for tracking network port usage.

Knowing which application or process is using a port (as shown by PortsMonitor) is the first step is understanding why a port is open or listening. As an example, the Control Centre process is, on my Mac, listening on TCP ports 5000 and 7000.

Here is the official (but incomplete) list of TCP and UDP ports used by Apple software .

Though not Apple specific, Wikipedia has a long list of port usage. But (at a quick scan) 95% of the listed high ports (greater than 1024) seem to be irrelevant for most Mac usage.

As a last comment, don't get stressed about port usage unless you have strong suspicion of malware or are in a high security environment.

Answer 2

The lsof command can be used to check for processes which are listing to ports.

$ lsof -i @localhost:1024-65545
COMMAND     PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
Notion     1048  pse   22u  IPv4 0x1b47a08ea8bc5bc5      0t0  TCP localhost:63405->localhost:49158 (ESTABLISHED)
Notion     1060  pse   27u  IPv4 0x1b47a08eb6275bc5      0t0  TCP localhost:49158 (LISTEN)
Notion     1060  pse   34u  IPv4 0x1b47a08eb62526f5      0t0  TCP localhost:49158->localhost:63405 (ESTABLISHED)
ArqMonito  2859  pse    5u  IPv4 0x1b47a08eb6265135      0t0  TCP localhost:49309->localhost:49051 (ESTABLISHED)
ArqMonito  2859  pse    6u  IPv4 0x1b47a08eb6265135      0t0  TCP localhost:49309->localhost:49051 (ESTABLISHED)
pEp-mini-  2874  pse   13u  IPv4 0x1b47a08eb626d135      0t0  TCP localhost:4223 (LISTEN)
SpamSieve  3438  pse   12u  IPv4 0x1b47a08eaba666f5      0t0  TCP localhost:49533 (LISTEN)
SpamSieve  3438  pse   35u  IPv4 0x1b47a08eaba666f5      0t0  TCP localhost:49533 (LISTEN)
Roon      28557  pse   68u  IPv4 0x1b47a08eaba61135      0t0  TCP localhost:56358->localhost:9004 (ESTABLISHED)
RAATServe 28560  pse    6u  IPv4 0x1b47a08eaba71bc5      0t0  TCP localhost:9004 (LISTEN)
RAATServe 28560  pse   71u  IPv4 0x1b47a08eb6257185      0t0  TCP localhost:9004->localhost:56358 (ESTABLISHED)