5

TCP port 5901 is open on my machine and is causing some mischief, and I want to know which process is opening it. When I run lsof -i -P I see that launchd is the process that opened the port.

Is there a quick way I can determine which launchd plist file is being used to open that port? I'd rather not have to go through each plist mentioned by launchctl list.

Improve this question

2 Answers 2

Reset to default
5

First, is this being opened by the system launchd (process ID 1, running as root), or a user launchd (running as a user)? If it's the system launchd, you're looking for a LaunchDaemon; if it's a user launchd, you're looking for a LaunchAgent.

Assuming it's the system launchd, you can look for the relevant LaunchDaemon like this:

grep 5901 {,/System}/Library/LaunchDaemons/*

(note: if port 5901 were listed in /etc/services, you'd also have to look for it by name as well as number. But it isn't, so you don't have to worry about that.)

It's also possible that it's a LaunchDaemon that was loaded from some other place; tracking that down would be messy, so start with the easy check first.

Improve this answer
1
  • Awesome grep there. Nice generalization on /etc/services as well.
    – bmike ♦
    Nov 22, 2012 at 5:01
1

Port 5901 is used for VNC (Remote Desktop screen sharing on OS X) and by design launchd actually reads all of the configuration files that are loaded on your Mac and then listens on ports rather than starting the program that eventually will receive communications on that port.

In this case, since you only see launchd and not a screensharingd or ScreensharingAgent process you might just be able to conclude that launchd is listening as a proxy for another process that isn't running at present (or perhaps yet to run).

You can test this by disabling the screen sharing settings in System Preferences or uninstalling any other remote VNC server software you have and then re-examining lsof.

Improve this answer
2
  • So we don't have any VNC software that I'm aware of installed on the computer. In addition, screen sharing and all remote management services have been disabled, yet the port is still open. I know some process is associated with that port because when I connect to it through netcat it crashes my machine.
    – tifkin
    Nov 21, 2012 at 15:43
  • Hmm - I can't think of another short cut other than the one you want to avoid - figuring out which plist is making launchd listen on 5901. I don't have any systems listening in on that port - so hopefully it's something innocent and not malware.
    – bmike ♦
    Nov 21, 2012 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .