Find which process is listening on port 8001 on Mac OS X

Question

How can I see which process is listening on port 8001 on Mac OS X?

I have tried several commands:

lsof -i | grep LISTEN

Output:

qbittorre   321 user   26u  IPv4 0xc8e6037f28270c31      0t0  TCP *:6881 (LISTEN)
qbittorre   321 user   27u  IPv6 0xc8e6037f216348e1      0t0  TCP *:6881 (LISTEN)
mysqld    14131 user   10u  IPv4 0xc8e6037f3218da91      0t0  TCP *:mysql (LISTEN)
httpd     14133 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14135 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14136 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14137 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14138 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14139 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14148 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14149 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
httpd     14150 user   16u  IPv6 0xc8e6037f216352e1      0t0  TCP *:http (LISTEN)
Skype     14543 user   57u  IPv4 0xc8e6037f324f9a91      0t0  TCP *:18666 (LISTEN)
java      24640 user   68u  IPv6 0xc8e6037f3295a3e1      0t0  TCP *:http-alt (LISTEN)
java      24640 user   73u  IPv6 0xc8e6037f32958fe1      0t0  TCP *:8009 (LISTEN)
java      24640 user  101u  IPv6 0xc8e6037f32959ee1      0t0  TCP localhost:8005 (LISTEN)

lsof:

sudo lsof -nPi -sTCP:LISTEN | grep 8001

Nothing found

netstat:

netstat -a | grep 8001

Nothing found

I know that the port is in use by someone, because I am trying to change the Emacs simple-httpd default httpd-port from 8080 (default) to 8001, and it fails:

Warning (initialization): An error occurred while loading `/Users/user/.emacs':

File error: Cannot bind server socket, address already in use

To ensure normal operation, you should investigate and remove the
cause of the error in your initialization file.  Start Emacs with
the `--debug-init' option to view a complete error backtrace.

How can I resolve it? I tried also to set the port to 8002, with the same problem and didn't find which process is listening on port 8002.

What can be the source of the problem?

Using nmap I discovered that port 8001 is used by vcom-tunnel service and it’s a closed port and that port 8002 is used by teradataordbms and is also closed.

What are these services used for? Can I disable them and use their occupied ports?

Answer 1

You can use lsof to detect who is using the connection as long as there is active traffic on the connection.

Here is a demonstration:

• setting a server on a given port fails with the error Address already in use
• lsof doesn't report any listener for that port

Here is the shell log demonstrating this:

python -m SimpleHTTPServer 3333 2>&1 | fgrep error

Output:

socket.error: [Errno 48] Address already in use

sudo lsof -i TCP:3333
echo $?

Output:

1

[1] : starting a web server on port 3333 fails with the error Address already in use

[2] : lsof doesn't report port 3333 being used by anyone

Let's generate traffic in order to force lsof to detect the usage of the port: in another terminal open a telnet connection:

telnet localhost 3333

Now back on your previous terminal, you will see that lsof finds your port:

sudo lsof -n -P -i :3333

Output:

COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
telnet  78142 loic    5u  IPv4 0x3fa2e8474ece6129      0t0  TCP 127.0.0.1:51855->127.0.0.1:3333 (ESTABLISHED)

There is traffic going on, but according to the OS, only one end of the connection is there, the initiator, there still isn’t any `LISTENER`!

Note: in my case, OS is macOS v10.13.3 (High Sierra), but I had that with previous versions of macOS/OSX too