List all Open Internet Connections on a Mac to track down Bandwidth Issues

Sep 29, 2009 - 5 Comments

terminal-icon-512x5122 Recently the LAN at my office had been running slower than usual, and I couldn’t pinpoint what was using up all the extra bandwidth. I had a suspicion that P2P traffic was to blame but I just couldn’t see anything obvious on the offending machine. Using the lsof command line tool, we can pass the -i argument to list only the open internet connections on our Macs, and we can find out if there’s anything peculiar (or in my case, hidden) going on, and if so the process ID so that we can kill it.

I logged into the offending Mac and typed the following command
lsof -i

Here’s an example of the output displayed by this command:

MacMini:~ macuser$ lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
SystemUIS 93 macuser 6u IPv4 0x04db27bc 0t0 UDP *:*
SystemUIS 93 macuser 10u IPv4 0x04db26e0 0t0 UDP *:*
iChatAgen 111 macuser 6u IPv4 0x07084734 0t0 UDP localhost:49490->localhost:49490
iChatAgen 111 macuser 10u IPv4 0x05666f28 0t0 TCP 192.168.0.101:53762->bos-m012c-sdr6.blue.aol.com:aol (ESTABLISHED)
synergys 129 macuser 5u IPv4 0x05f2f6b0 0t0 TCP *:24800 (LISTEN)
Safari 148 macuser 10u IPv4 0x06db46e0 0t0 TCP 192.168.0.101:57557->host29.prod.google.com:http (CLOSE_WAIT)
iTunes 644 macuser 21u IPv4 0x05f2f2a4 0t0 TCP *:daap (LISTEN)

In the above display there’s nothing unusual, but in my aforementioned network troubleshooting, I discovered a BitTorrent client running hidden in the background of one of my networks Macs, and it was seeding several large files! Naturally I killed the BitTorrent client, removed the application, deleted the files, and the Mac LAN is running at full speed again.

If you happen to want to only display the established connections, use this command:
lsof -i | grep -E "(LISTEN|ESTABLISHED)"
You can combine this with ‘watch’ to get an automatically updated list of established connections too.

Enjoy this tip? Subscribe to the OSXDaily newsletter to get more of our great Apple tips, tricks, and important news delivered to your inbox! Enter your email address below:

Related articles:

Posted by: David Mendez in Command Line, How to, Tips & Tricks, Troubleshooting, Utilities

5 Comments

» Comments RSS Feed

  1. tertiumsquid says:

    Can I assume the perpetrator was disciplined for unauthorized use of company computers (if he/she was caught)?

  2. M25 says:

    Awwww, come on… torrent-ing the box office weekend movie isn’t worth the bandwidth speed? Hahaha…

    Seriously though, thanks for the tip. thats a really useful command line to know.

  3. […] want to stop the agent running. You probably noticed the agent using something like LittleSnitch or lsof when it tries to access an outside server (typically Akamai) when it checks for software updates. […]

  4. […] using a free command line utility called open_ports.sh. Open_Ports is much more useful than using lsof to list open internet connectionsbecause it provides extensive network information in a very easy to read format, including what […]

  5. […] are other ways to see similar information from the command line, including lsof, open_ports, and then, branching away from the command line a bit you can use GeekTool with lsof to […]

Leave a Reply

 

Shop for Apple & Mac Deals on Amazon.com

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates