Skip to content
All Posts

Network and System Commands on OS X

A command reference for inspecting listening ports, network connections, and system calls on OS X with lsof, netstat, telnet, and dtruss.

182 wordsView all posts with this tag macosView all posts with this tag networking

netstat on OS X is not especially convenient. It can show a port’s process ID, but not the program name. To list listening ports:

Terminal window
netstat -anLv
Output from netstat showing listening ports

Use lsof to see the program name:

Terminal window
lsof -ni | grep LISTEN
Output from lsof showing listening programs

To determine whether a particular port is listening, telnet is preferable because lsof returns nothing for ports you do not have permission to inspect.

Show TCP connections:

Terminal window
lsof -itcp

Show TCP connections over IPv6:

Terminal window
lsof -i6tcp

Show connections for a particular port:

Terminal window
lsof -i:1080

Append grep for more specific connection states. I generally use grep -i to avoid missing results because of letter case.

Sometimes lsof displays a service name such as callbook instead of the port number. Add -P to disable that conversion:

Terminal window
lsof -P -itcp:2000

Trace a process’s system calls

Use dtruss on macOS; the corresponding Linux command is strace. It requires sudo.

Terminal window
dtruss df -h       # run and examine "df -h"
dtruss -p 1871     # examine PID 1871
dtruss -n tar      # examine all processes called "tar"
dtruss -f test.sh  # run test.sh and follow children

The macOS dtrace command corresponds to ltrace on Linux.

Originally published on SegmentFault.