Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm on OSX Mountain Lion 10.8.3, and I've freshly rebooted my Mac.

I want to start a service (like Apache on port 80), but there is already something going on with port 80:

telnet localhost 80

Trying ::1...
Connected to localhost.
Escape character is '^]'.

Wait, I hear you say, you can find that with lsof or netstat. Except there is nothing there

netstat -an | grep LISTEN | grep '\.80'

*comes back blank*

lsof -i :80 | grep LISTEN

*comes back blank

So from what I know about unix systems, I figure this must be a packet forwarding rule then? I.e. packets are being forwarded from inbound port 80 to something else, which is listening on that service.

ipfw show

65535 0 0 allow ip from any to any

Hmm, nothing unusual there

pfctl -s nat

No ALTQ support in kernel
ALTQ related functions disabled

Nothing unusual there

My question is, how can I display any packet forwarding rules... On Linux I might just do iptables -L -t NAT, or iptables -L. Or alternatively, can any OSX experts help me diagnose this problem?

share|improve this question
Not a direct answer to your interesting question, but: what if you point your browser to http://localhost? – Arjan May 19 '13 at 18:02
The lsof grep you used would come back blank; port numbers are mapped to /etc/services names. Try lsof -i | grep http... – Nevin Williams May 20 '13 at 1:35
Actually, the /etc/services mapping isn't a problem if you use the -i :port format, only if you grep. What will be a problem is that lsof needs root privs to see other users' processes, so you should use sudo lsof -i :80 (and I'd try it without the grep, just to make sure...) – Gordon Davisson May 20 '13 at 5:41
Hi all, thanks for the suggestions so far, but hasn't turned up anything - even as root, and without greps, there is nothing listed as actually listening to port 80. – geoff May 20 '13 at 8:21
Did you try lsof -i :80 while still connected in that Telnet session? And apart from trying http://localhost/, maybe typing something at that Telnet prompt reveals something...? (Again, I know: even if you figure it out that way, it would not be the answer to your question...) – Arjan May 20 '13 at 21:21
up vote 15 down vote accepted

You need to run these commands as root to show other users' processes, for example:

sudo lsof -i ':80'

Mac OS X includes an Apache web server that can be controlled using apachectl as root. It's usually started via launchd, the corresponding configuration file is /System/Library/LaunchAgents/org.apache.httpd.plist. If it's not this Apache running on port 80, it is probably launchd, Apple's implementation of a daemon manager. According to Wikipedia:

When launchd scans through the job plists at boot time it reserves and listens on all of the ports requested by those jobs. If so indicated in the plist by the "OnDemand" key, the daemon is not actually loaded at the time. Rather, launchd will listen on the port, start the daemon when needed, and shut it down when it is not. After a daemon is loaded, launchd will keep track of it and make sure it is running if needed.

share|improve this answer
So then I guess my idea was right that sudo lsof -i ':80' might not actually return anything, unless one runs that while connected in the Telnet session? But even without those commands, http://localhost/ would probably still have shown some Apache welcome page? – Arjan May 21 '13 at 20:42
(I believe your answer is probably the solution; it just doesn't match all comments from the OP.) – Arjan May 21 '13 at 20:43
Thanks for this brilliant answer. I've now managed to solve it: 1. There was a mistake in httpd.conf, so sudo apachectl start was not starting apache. 2. But launchd was listening on port 80, ready to forward requests to a non-existent server. 3. However launchd wasn't listening in the conventional sense - that is - the results of sudo lsof -i :80 was blank, likewise for netstat 4. I guess launchd does some magic like xinetd in that it doesn't officially listen on a port, but somehow manages to allow connections to the port by bribing the kernel. – geoff May 22 '13 at 11:50

Just to make the actual answer clear in case users are searching for this.

  1. launchd scans the /System/Library/LaunchDaemons/ on boot and works out from org.apache.httpd.plist that it when apache is started it needs to forward port 80 onto it.

  2. sudo apachectl start was done

  3. However there was a mistake in the httpd.conf file meaning apache was not started, although this was not reported via the apachectl command.

  4. Launchd decided to listen on port 80 as it thought apache was up.

  5. But the contents of any HTTP request resulted in an immediate close of the connection.

  6. sudo lsof -i :80 yielded no answers

  7. sudo netstat -an | grep LISTEN yielded no answers for port 80

  8. there was no information so far as I could tell in any diagnostic tools that showed that port 80 was in-use or listening.

  9. fixing apache's httpd.conf and restarting apache successfully so httpd was in the ps table, led HTTP requests to be successful.

  10. I was therefore mistaking that I couldn't run apache because there was already something listening on port 80, rather than apache conf itself was the cause

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.