List all Open Internet Connections on a Mac to track down Bandwidth Issues
Recently the LAN at my office had been running slower than usual, and I couldn’t pinpoint what was using up all the extra bandwidth. I had a suspicion that P2P traffic was to blame but I just couldn’t see anything obvious on the offending machine. Using the lsof command line tool, we can pass the -i argument to list only the open internet connections on our Macs, and we can find out if there’s anything peculiar (or in my case, hidden) going on, and if so the process ID so that we can kill it.
I logged into the offending Mac and typed the following command
Here’s an example of the output displayed by this command:
MacMini:~ macuser$ lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
SystemUIS 93 macuser 6u IPv4 0x04db27bc 0t0 UDP *:*
SystemUIS 93 macuser 10u IPv4 0x04db26e0 0t0 UDP *:*
iChatAgen 111 macuser 6u IPv4 0x07084734 0t0 UDP localhost:49490->localhost:49490
iChatAgen 111 macuser 10u IPv4 0x05666f28 0t0 TCP 192.168.0.101:53762->bos-m012c-sdr6.blue.aol.com:aol (ESTABLISHED)
synergys 129 macuser 5u IPv4 0x05f2f6b0 0t0 TCP *:24800 (LISTEN)
Safari 148 macuser 10u IPv4 0x06db46e0 0t0 TCP 192.168.0.101:57557->host29.prod.google.com:http (CLOSE_WAIT)
iTunes 644 macuser 21u IPv4 0x05f2f2a4 0t0 TCP *:daap (LISTEN)
In the above display there’s nothing unusual, but in my aforementioned network troubleshooting, I discovered a BitTorrent client running hidden in the background of one of my networks Macs, and it was seeding several large files! Naturally I killed the BitTorrent client, removed the application, deleted the files, and the Mac LAN is running at full speed again.
If you happen to want to only display the established connections, use this command:
lsof -i | grep -E "(LISTEN|ESTABLISHED)"
You can combine this with ‘watch’ to get an automatically updated list of established connections too.