>

List Every Open Network Connection with lsof

One forgotten command shows all sockets on the Mac with the owning process, unlike netstat's bare connection table.

macOSsocketslsofauditLow risk
Run `lsof -i -P -n` to list all open TCP/UDP sockets together with the process that owns each one.

01Command

Command
$ lsof -i -P -n

02What it does

The -i selector restricts lsof to internet sockets; -P keeps port numbers as numbers instead of service names, and -n skips reverse DNS lookups so output appears instantly. The result shows PID, process name, user, and local/remote addresses — ideal for auditing what is quietly phoning home. Pipe it through grep ESTABLISHED for live connections or grep LISTEN for local servers.

03Risk

RiskLow risk
RequirementsBuilt-in on macOS; full output for all users' processes requires sudo.
!Warning: Without sudo, lsof only reports sockets owned by your own user, which can look like an incomplete list.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • lsof — list open files (macOS)
    SS64 · technical · 2026-09-17
    Evidence: Documents -i to select Internet addresses, -P to avoid port-name conversion, and -n to skip hostname lookups.

Last verified: 2026-09-17 · Category: Network

06Related solutions

Find Which Process Has a File or Volume Open with lsof
macOSFilesprocesslsof

List every open file descriptor — files, directories, and network sockets — per process.

Low risk ✓ 2026-09-17