40

I'm on OSX Mountain Lion 10.8.3, and I've freshly rebooted my Mac.

I want to start a service (like Apache on port 80), but there is already something going on with port 80:

telnet localhost 80

Trying ::1...
Connected to localhost.
Escape character is '^]'.

Wait, I hear you say, you can find that with lsof or netstat. Except there is nothing there

netstat -an | grep LISTEN | grep '\.80'

*comes back blank*

lsof -i :80 | grep LISTEN

*comes back blank

So from what I know about unix systems, I figure this must be a packet forwarding rule then? I.e. packets are being forwarded from inbound port 80 to something else, which is listening on that service.

ipfw show

65535 0 0 allow ip from any to any

Hmm, nothing unusual there

pfctl -s nat

No ALTQ support in kernel
ALTQ related functions disabled

Nothing unusual there

My question is, how can I display any packet forwarding rules... On Linux I might just do iptables -L -t NAT, or iptables -L. Or alternatively, can any OSX experts help me diagnose this problem?

7
  • Not a direct answer to your interesting question, but: what if you point your browser to http://localhost?
    – Arjan
    May 19, 2013 at 18:02
  • The lsof grep you used would come back blank; port numbers are mapped to /etc/services names. Try lsof -i | grep http... May 20, 2013 at 1:35
  • 1
    Actually, the /etc/services mapping isn't a problem if you use the -i :port format, only if you grep. What will be a problem is that lsof needs root privs to see other users' processes, so you should use sudo lsof -i :80 (and I'd try it without the grep, just to make sure...) May 20, 2013 at 5:41
  • 1
    Hi all, thanks for the suggestions so far, but hasn't turned up anything - even as root, and without greps, there is nothing listed as actually listening to port 80.
    – geoff
    May 20, 2013 at 8:21
  • Did you try lsof -i :80 while still connected in that Telnet session? And apart from trying http://localhost/, maybe typing something at that Telnet prompt reveals something...? (Again, I know: even if you figure it out that way, it would not be the answer to your question...)
    – Arjan
    May 20, 2013 at 21:21

3 Answers 3

55
+50

You need to run these commands as root to show other users' processes, for example:

sudo lsof -i ':80'

Mac OS X includes an Apache web server that can be controlled using apachectl as root. It's usually started via launchd, the corresponding configuration file is /System/Library/LaunchAgents/org.apache.httpd.plist. If it's not this Apache running on port 80, it is probably launchd, Apple's implementation of a daemon manager. According to Wikipedia:

When launchd scans through the job plists at boot time it reserves and listens on all of the ports requested by those jobs. If so indicated in the plist by the "OnDemand" key, the daemon is not actually loaded at the time. Rather, launchd will listen on the port, start the daemon when needed, and shut it down when it is not. After a daemon is loaded, launchd will keep track of it and make sure it is running if needed.

5
  • So then I guess my idea was right that sudo lsof -i ':80' might not actually return anything, unless one runs that while connected in the Telnet session? But even without those commands, http://localhost/ would probably still have shown some Apache welcome page?
    – Arjan
    May 21, 2013 at 20:42
  • (I believe your answer is probably the solution; it just doesn't match all comments from the OP.)
    – Arjan
    May 21, 2013 at 20:43
  • 1
    Thanks for this brilliant answer. I've now managed to solve it: 1. There was a mistake in httpd.conf, so sudo apachectl start was not starting apache. 2. But launchd was listening on port 80, ready to forward requests to a non-existent server. 3. However launchd wasn't listening in the conventional sense - that is - the results of sudo lsof -i :80 was blank, likewise for netstat 4. I guess launchd does some magic like xinetd in that it doesn't officially listen on a port, but somehow manages to allow connections to the port by bribing the kernel.
    – geoff
    May 22, 2013 at 11:50
  • 3
    For me what solved the issue was running sudo apachectl stop in the terminal.
    – MikeiLL
    May 26, 2017 at 2:34
  • 1
    This did not work for me, but this version did show what was running (OS High Sierra 10.13.6) sudo lsof -i -P | grep -i "80" from superuser.com/questions/984919/…
    – RoboBear
    Aug 27, 2018 at 0:24
11

Just to make the actual answer clear in case users are searching for this.

  1. launchd scans the /System/Library/LaunchDaemons/ on boot and works out from org.apache.httpd.plist that it when apache is started it needs to forward port 80 onto it.

  2. sudo apachectl start was done

  3. However there was a mistake in the httpd.conf file meaning apache was not started, although this was not reported via the apachectl command.

  4. Launchd decided to listen on port 80 as it thought apache was up.

  5. But the contents of any HTTP request resulted in an immediate close of the connection.

  6. sudo lsof -i :80 yielded no answers

  7. sudo netstat -an | grep LISTEN yielded no answers for port 80

  8. there was no information so far as I could tell in any diagnostic tools that showed that port 80 was in-use or listening.

  9. fixing apache's httpd.conf and restarting apache successfully so httpd was in the ps table, led HTTP requests to be successful.

  10. I was therefore mistaking that I couldn't run apache because there was already something listening on port 80, rather than apache conf itself was the cause

1
  • So what was wrong with httpd.conf? I'm having this problem now and I'm not sure how to proceed based on your answer here..?? Jul 18, 2017 at 5:42
0

I just ran into this same problem with OSX El Capitan and Avast antivirus. sudo lsof -i ':80' showed a connection to avast.com.

me@destop ~|master$ sudo lsof -i ':80'
Password:
COMMAND    PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
com.avast 7964 root   58u  IPv4 0xc4c1bba31fcc2c7f      0t0  TCP 192.168.100.111:52381->mia04-004.ff.avast.com:http (ESTABLISHED)

I had to

  1. uninstall Avast with /Applications/Uninstall Avast.app
  2. sudo rm -rf "/Library/Application Support/Avast" "/Applications/Avast Business Security.app" "/Applications/Uninstall Avast.app"
  3. restart

to prevent it from using it port 80.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .