netstat: n: unknown or uninstrumented protocol

Question

I always use netstat on ubuntu to check which processes are listening on specific ports. I use the following switches with netstat that work fine on ubuntu but on mac fail:

sudo netstat -tulpn
netstat: n: unknown or uninstrumented protocol

Answer 1

Linux's netstat command options and OS X(/BSD)'s have almost nothing to do with each other. Of the options you're invoking, only -n means the same on both, and some of the others (-l and -p) have no equivalent on OS X's netstat. What I habitually use on OS X is netstat -an | grep LISTEN, but that doesn't show UDP or the program involved. I suppose you could use netstat -an | egrep '^udp|LISTEN' to include UDP, but that's rather verbose (and you'll also see quite a bit of nonsense UDP stuff, since there isn't really a concept of UDP listening vs. other states). If you need to know the program, you need to go to the lsof (list open files) command, and that requires root access to check processes you don't own. Try something like sudo lsof -nPi -sTCP:LISTEN

Edit: as @loic.jaouen pointed out in another answer, while OS X's netstat doesn't have a direct equivalent to the Linux's -p option, the -v (verbose) display does include the PID of the process, and you can get the program name from that with ps.

Answer 2

@gordon-davisson is right, but you can still get the pid from netstat on mac with the verbove option. I post an answer as I lack the reputation to comment his answer.

---

So, if the question is how to get pid and port in a netstat command, you can still do:

netstat -anv

the verbose option gives the pid in postition 9 like this:

Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)     rhiwat shiwat    pid   epid
tcp4       0      0  127.0.0.1.3335         *.*                    LISTEN      131072 131072  45710      0

But the output is plethoric, which is bearable if you know what you look for, like: netstat -anv | grep 3335 or netstat -anv | grep LISTEN

The output of lsof is still nicer.

Answer 3

You can let your Mac "listen" on a network interface:

Type sudo tcpdump -i en0 (followed by your administrator password)