I thought I left an express server open on localhost so I ran a Rustscan port scanner and got these result,

Open [::1]:5000
Open [::1]:5432
Open [::1]:7000
Open [::1]:55743

For 5000 I noticed has always been open ever since I updated to macOS Monterey, for 55743 I assume is open because I am in a zoom call for class but not sure about the other two, 7000 and 5432. (7000, 5432 are not from any of my local development servers unless process.env.PORT is set to them which I doubt)

I did some research and can’t select any tool out there I can download to relieve worries of malicious software operating on these ports.

Also when I go to localhost:7000, 5432 I get http error 403 access denied.

Is there a way I could analyze these ports with more depth to see why my computer has them open?

  • What malicious software opens ports? Any chance you could document your research (what term did you search) and why the top 5 links don’t help you solve this? (And ignore my comment if you are going to select one of the existing answers)
    – bmike
    Commented Feb 9, 2022 at 23:33

2 Answers 2


PortsMonitor is my favourite GUI tool for tracking network port usage. enter image description here

Knowing which application or process is using a port (as shown by PortsMonitor) is the first step is understanding why a port is open or listening. As an example, the Control Centre process is, on my Mac, listening on TCP ports 5000 and 7000.

Here is the official (but incomplete) list of TCP and UDP ports used by Apple software .

Though not Apple specific, Wikipedia has a long list of port usage. But (at a quick scan) 95% of the listed high ports (greater than 1024) seem to be irrelevant for most Mac usage.

As a last comment, don't get stressed about port usage unless you have strong suspicion of malware or are in a high security environment.

  • Ok awesome this is what I was looking for thank you. Commented Jan 10, 2022 at 22:58

The lsof command can be used to check for processes which are listing to ports.

$ lsof -i @localhost:1024-65545
Notion     1048  pse   22u  IPv4 0x1b47a08ea8bc5bc5      0t0  TCP localhost:63405->localhost:49158 (ESTABLISHED)
Notion     1060  pse   27u  IPv4 0x1b47a08eb6275bc5      0t0  TCP localhost:49158 (LISTEN)
Notion     1060  pse   34u  IPv4 0x1b47a08eb62526f5      0t0  TCP localhost:49158->localhost:63405 (ESTABLISHED)
ArqMonito  2859  pse    5u  IPv4 0x1b47a08eb6265135      0t0  TCP localhost:49309->localhost:49051 (ESTABLISHED)
ArqMonito  2859  pse    6u  IPv4 0x1b47a08eb6265135      0t0  TCP localhost:49309->localhost:49051 (ESTABLISHED)
pEp-mini-  2874  pse   13u  IPv4 0x1b47a08eb626d135      0t0  TCP localhost:4223 (LISTEN)
SpamSieve  3438  pse   12u  IPv4 0x1b47a08eaba666f5      0t0  TCP localhost:49533 (LISTEN)
SpamSieve  3438  pse   35u  IPv4 0x1b47a08eaba666f5      0t0  TCP localhost:49533 (LISTEN)
Roon      28557  pse   68u  IPv4 0x1b47a08eaba61135      0t0  TCP localhost:56358->localhost:9004 (ESTABLISHED)
RAATServe 28560  pse    6u  IPv4 0x1b47a08eaba71bc5      0t0  TCP localhost:9004 (LISTEN)
RAATServe 28560  pse   71u  IPv4 0x1b47a08eb6257185      0t0  TCP localhost:9004->localhost:56358 (ESTABLISHED)
  • That command only lists processes listening or connected on localhost - i.e. those that can be used by another process on the Mac. lsof -i would be more complete.
    – Gilby
    Commented Jan 10, 2022 at 22:38
  • @gilby Not sure I understand? Knowing the processes which have open ports helps to understand why they are open. What am I missing?
    – nohillside
    Commented Jan 11, 2022 at 6:52
  • Your command only shows processes and connections using localhost. So excludes all connections (or listeners) via Ethernet or Wifi.
    – Gilby
    Commented Jan 11, 2022 at 10:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .