How to Find Who/What is Listening on TCP Ports on Mac

Occasionally you may find yourself in a situation where you are seeking to find what open TCP connections are in a listening state on a Mac. This can be useful whether you’re troubleshooting particular network issues, or simply looking to identify which processes are listening on specific ports on a Mac.

We’ll be using the command line lsof tool to find out what/who is listening on open TCP connections on a Mac, making this most appropriate for advanced Mac users who are comfortable with the Terminal and sudo.

How to Find What Listens on TCP Ports on MacOS

The command we’ll use here is aimed at MacOS Ventura and MacOS Monterey, but should work on older MacOS versions as well:

1. Open the “Terminal” application from /Applications/Utilities/ or through Spotlight with Command+Spacebar
2. Type the following command:

sudo lsof -iTCP -sTCP:LISTEN -P -n

3. Hit enter and use the admin password when requested to execute the command and see a list of what is actively listening on which TCP ports on the Mac

You will see a list of commands / processes, the process ID (PID), type (IPv6 vs IPv4), device, node (TCP in this case), and the port.

With this information you can determine your next steps, depending on what your objectives are.

For those curious, let’s breakdown the command and the various flags used here used here:

• sudo: Runs the command with superuser privileges, allowing it to display network connections opened by all users, including root.
• lsof: Lists all open files on the system, including open network connections.
• -iTCP: Filters the results to show only TCP connections.
• -sTCP:LISTEN: Filters the results to show only listening TCP connections.
• -P: Disables port name resolution, displaying only port numbers.
• -n: Disables hostname resolution, displaying only IP addresses.

The lsof command is quite powerful, and we’ve covered it’s usage before with determining what apps or processes are interacting with a particular file, finding what processes are using internet connectivity, displaying open network connections, listening all open internet connections, and more.

BTW if you prefer the GUI, you can try out the Sloth app, which is basically a GUI front-end to lsof, and available as a free download, and Activity Monitor has limited support for similar features as well.

Do you have any similar tricks, commands, or tools you use to find what or who is listening to any given TCP port on a Mac? Let us know in the comments below.