Lots of CLOSED tcp6 ports shown in netstat

Question

Level 1

10 points

Lots of CLOSED tcp6 ports shown in netstat

Netstat shows lots of CLOSED tcp6 connections. Before my last reboot it was more than 30000 and new outgoing IPv6 connections were no longer possible. Any idea how to find out which process causes them?

MacOS Ventura 13.2, arm64 (Mac Studio)

Example:

netstat -anv -f inet6 
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)      rhiwat  shiwat    pid   epid state  options           gencnt    flags   flags1 usscnt rtncnt fltrs
...
tcp6       0      0  *.51782                *.*                    CLOSED      7405568 7405568      0      0 00080 00000008 0000000000145230 00000002 00100800      1      0 000001
tcp6       0      0  *.51778                *.*                    CLOSED      7405568 7405568      0      0 00080 00000008 0000000000145029 00000002 00100800      1      0 000001
tcp6       0      0  *.51775                *.*                    CLOSED      7405568 7405568      0      0 00080 00000008 0000000000144fc0 00000002 00100800      1      0 000001
tcp6       0      0  *.51773                *.*                    CLOSED      7405568 7405568      0      0 00080 00000008 0000000000144f85 00000002 00100800      1      0 000001

Mac Studio, macOS 13.2

Posted on Feb 10, 2023 5:03 AM

Reply

Answer 1

wolfgang66 Author

Level 1

10 points

Feb 17, 2023 1:28 AM in response to MrHoffman

Found something. Not using lsof, but when I smb-mounted a network file system, the number of closed ports rised by 74.

So, obviously smb-mounting networks files via IPv6 is the problem.

Reply

Answer 2

wolfgang66 Author

Level 1

10 points

Feb 17, 2023 1:46 AM in response to wolfgang66

Confirmed this on another Mac - same happens there. Opening an SMB-connection via IPv6 leaves me with lots of closed tcp6 ports which do not disappear.

Reply

Answer 3

Feb 10, 2023 12:03 PM in response to wolfgang66

A command-line command useful for locating processes with open ports is lsof.

An example:

sudo lsof -i6 -n -P -sTCP:LISTEN

or

sudo lsof -i6 -n -P

nmap (via Homebrew or otherwise) and mirroring a not-dumb switch port might show some data, as alternatives.

Reply

Answer 4

Feb 11, 2023 6:44 AM in response to wolfgang66

wolfgang66 wrote:

lsof shows sockets in open or in listen state. It does not show CLOSED ones. Now at 205 CLOSED sockets.

Yes, and the sockets that are in closed were once open, and I’d be curious if those stuck-closed ports are all arising from a particular app. Whether those are closed sockets from a malfunctioning app, or maybe where (for instance) something such as a firewall or add-on security app is getting involved. Orbtangled.

Reply

Answer 5

wolfgang66 Author

Level 1

10 points

Feb 10, 2023 11:51 PM in response to MrHoffman

lsof shows sockets in open or in listen state. It does not show CLOSED ones. Now at 205 CLOSED sockets.

Reply

Lots of CLOSED tcp6 ports shown in netstat

Similar questions