7 Replies Latest reply: Sep 25, 2010 4:55 PM by avraamjack
thefsb Level 1 (10 points)
In other BSD unixes, sockstat(1) is the convenient way to find the PID of the owner of a socket. In OS X the man page for netstat(1) mentions it in the SEE ALSO section, but it doesn't appear to be a part of OS X.

If so, is there another convenient way to find the same information?

Late 2006 24" iMac, Mac OS X (10.6.3)
  • BobHarris Level 6 (17,734 points)
    How about lsof?
  • Nils C. Anderson Level 4 (3,495 points)
    just adding detail to what Bob suggested.

    sudo lsof -i


    lsof -i [46][protocol][@hostname|hostaddr][:service|port]

    so something like:

    sudo lsof -i 4tcp:631
    launchd 1 root 19u IPv4 0x0480bb4c 0t0 TCP localhost:ipp (LISTEN)
    cupsd 19 root 6u IPv4 0x0480bb4c 0t0 TCP localhost:ipp (LISTEN)
  • thefsb Level 1 (10 points)
    lsof to the rescue. Splendid! Thank you.
  • KXsig Level 2 (305 points)
    Hi there,

    And as we got so far, get the port numbers assigned to services in you /etc/services file.

    Cheers, K.
  • avraamjack Level 1 (5 points)
    I was just about to post the same question but fortunately did a search on sockstat.

    netstat -a shows open ports and connections ( http ) that lsof -i does not seem to list. I wanted bytes in and out per open port but do not see that option.

    The netstat man page does list sockstat in the "SEE ALSO" section. At the very least, apple should do a better job maintaining its man pages.

    I came to this question because my mini was doing a suspiciously large amount of network IO and I wanted to find out not only which ports were open but as much about them as possible, especially how much IO per port.

    Avraam Jack Dectis
  • KXsig Level 2 (305 points)
    Hi A,

    Great to know. Would you be kind enough to share with us the used commands and arguments?

    Cheers, K.
  • avraamjack Level 1 (5 points)
    My previous post may have been unclear.

    I do not see an option for amount of IO on a per port basis.

    That is what I am looking for.

    I wonder if that information is available in the kernel.

    If it is, there should be a command to get it. It is something that is very informative.