28

I'm on an OS X Mountain Lion laptop and have a couple of Vagrant boxes on it. I'm trying to figure out which process is listening on port 8080. My variations produce like a hundred lines but none with specific port number. I'm assuming something like:

netstat -XXX | grep 8080
3
  • Is this in a home setting or professional environment? Aug 3, 2013 at 1:53
  • well, recreating an server enviro locally. if you want to move to different site, that's fine. Different versions of netstat support different arguments.
    – timpone
    Aug 3, 2013 at 1:57
  • Okay then sir, everything seems in order here, please carry on and have a nice day. Aug 3, 2013 at 1:59

8 Answers 8

57

Unfortunately on OSX you're stuck with the BSD netstat which will not show you the process ID that is attached to a given port. What you have to do instead is use lsof. The syntax you'll need to use is:

lsof -i :8080

This will print out gobs of information, most of which you don't care about, but the fields are well labeled. For example, check out this example output.

lsof -i :53237
COMMAND   PID  USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
GoogleTal 927 guest   29u  IPv4 0x2c3f7f95244855c3      0t0  TCP localhost:53237 (LISTEN)

This tells me that port 53237 is in use by process ID 927. When reading the COMMAND field keep in mind that this output is truncated, in reality the full name of the binary is GoogleTalkPlugin.

3
  • thx, this gets me a lot closer, it's going to a fairly generic VBoxHeadl - is there any way to see which VirtualBox instance (have two right now) or am I asking way too much (propably the latter). thx
    – timpone
    Aug 3, 2013 at 2:07
  • 1
    @timpone: I don't know enough about VirtualBox to help you down that path. You can check the process command line to see if it's listed there, or use lsof -p PID and browse the list of open files until you find it.
    – Scott Pack
    Aug 3, 2013 at 2:14
  • cool, thx for help
    – timpone
    Aug 3, 2013 at 2:17
8

This is what I like to use when looking for a listening port's PID. For Linux use: netstat -tunlp

  • n network
  • l listening ports
  • p process
  • t tcp
  • u udp

Additional information can be found in the man pages.

3
  • -p does not list the arguments to the program. How do I see this? Oct 29, 2015 at 16:06
  • 5
    OP asked about OSX. -p is not an option on OSX version of netstat.
    – Ted Bigham
    Nov 13, 2015 at 19:59
  • -p on OSX is port. I hate the developers decisions to make different arguments for OSX and Linux...
    – Daniel W.
    Jan 25, 2019 at 10:50
6

I was in the process of modifying netstat on OS X to provide this feature and stumbled upon the fact that -v will give you the pid associated with a socket.

2
4

For me, the following two lines work best to show which apps have listening ports open, and tunnel, lsof is fully cross-platform:

netstat -Watn | grep LISTEN
lsof -Pnl +M -i -cmd | grep LISTEN
1

To find out specific port use below netstat command

  netstat -an | grep ':8080'
1
  • 3
    OP asked about getting the process. This does not show the process id.
    – Ted Bigham
    Nov 13, 2015 at 20:00
1

From man netstat

-p, --program Show the PID and name of the program to which each socket belongs.

I usually just do this: netstat -antup | grep 8080

5
  • hmm... this sounds like what I'd like but this is giving me different options on OS X for -p -p protocol Show statistics about protocol, which is either a well-known name
    – timpone
    Aug 3, 2013 at 1:58
  • @timpone: The -p to display the PID is a GNU netstat command whereas OSX uses BSD netstat.
    – Scott Pack
    Aug 3, 2013 at 2:10
  • -p does not list the arguments to the program. How do I see this? Oct 29, 2015 at 16:06
  • 1
    OP asked about OSX. -p is not an option on OSX version of netstat.
    – Ted Bigham
    Nov 13, 2015 at 19:59
  • -p on OSX is port. I hate the developers decisions to make different arguments for OSX and Linux...
    – Daniel W.
    Jan 25, 2019 at 10:50
0

The below command shows the connection:

netstat -antop | grep :8080

For viewing the complete flow in realtime you could use watch:

watch -d -t -n 1 'lsof -n -i :8080'
0

On Ubuntu 18.04 and

netstat --version
net-tools 2.10-alpha

sudo netstat -ltnpv | grep 53

is the correct netstat command flag. 6th column is showing you the process.

tcp        0      0 127.0.0.1:5335          0.0.0.0:*               LISTEN      21219/unbound       
tcp        0      0 127.0.0.1:8953          0.0.0.0:*               LISTEN      21219/unbound       
tcp        0      0 192.168.5.165:7135      0.0.0.0:*               LISTEN      2538/python3        
tcp        0      0 192.168.5.165:7138      0.0.0.0:*               LISTEN      2539/python3        
tcp6       0      0 :::53                   :::*                    LISTEN      17715/docker-proxy  

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.