Listening port

Also: open ports, what is using port 3000

Quick answer

A listening port is a network port where a process is waiting for incoming connections, such as a web server on port 3000. Only one process can listen on a given port and address at a time, which is why you see errors like "address already in use".

Development servers, databases, and some apps open listening ports. When you start a server and it fails because the port is taken, another process, often an earlier copy of the same server, is still listening there.

Activity Monitor can show a process's open files and ports, but the fastest way to find which process owns a port is the `lsof` command in Terminal.

How to find what is using a port

Run lsof -nP -iTCP:3000 -sTCP:LISTEN in Terminal, replacing 3000 with your port. The output shows the command name and its PID.

To list every listening TCP port, run lsof -nP -iTCP -sTCP:LISTEN. Add sudo in front to include processes owned by other users.

How to free a port

If the process is a server you started, stop it the normal way first, for example with Control-C in the terminal where it runs. Otherwise, run kill <PID> with the PID from lsof. Use kill -9 <PID> only if it does not exit.

Check the process name before you stop it. Some ports belong to macOS services, such as AirPlay Receiver, which listens on ports 5000 and 7000 on recent versions of macOS.

How to see ports in Activity Monitor

Double-click a process and open the Open Files and Ports tab. It lists the files and network connections the process has open.

How to read the lsof output

Each line is one open socket. A server usually shows two lines, one for IPv4 and one for IPv6, with the same PID.

COMMAND is the process name, cut to 9 characters by default. Add +c 0 to see the full name: lsof +c 0 -nP -iTCP -sTCP:LISTEN.
PID is the process ID you pass to kill or ps.
USER is the account that runs it. Processes owned by root are usually part of macOS or an installed service.
NAME shows the address and port. *:3000 means the server accepts connections on every network interface. 127.0.0.1:3000 or [::1]:3000 means only this Mac can connect.

How to see which project a dev server belongs to

The process name is often just node, python or ruby, which does not tell you which project is running. Two commands answer that.

Get the PID with lsof -nP -iTCP:3000 -sTCP:LISTEN.
Run ps -o pid,ppid,command -p <PID> to see the full command that started it.
Run lsof -a -p <PID> -d cwd to see the folder it is running in, which is usually the project folder.
If the PPID points to a shell, the server was started from a terminal window. Stop it there with Control-C if that window is still open.

Why the port is taken when nothing seems to be running

If the port belongs to AirPlay Receiver, run your server on a different port, or turn off AirPlay Receiver in System Settings > General, in the AirDrop section.

A server from an earlier session is still running in a terminal tab or window you forgot about.
A server was started in the background, or by an editor or another tool, and has no visible window.
The server crashed but a child process it started is still holding the port.
A macOS service uses the same port, such as AirPlay Receiver on ports 5000 and 7000.

The Ports column in Activity Monitor is not network ports

Activity Monitor has an optional Ports column on the CPU tab. It counts Mach ports, a messaging mechanism macOS uses between processes, the same figure top shows as ports. It does not list network ports. For network ports, use lsof or the Open Files and Ports tab in a process's info window.

Questions people ask

How do I see what is using port 3000 on a Mac?

Run `lsof -nP -iTCP:3000 -sTCP:LISTEN` in Terminal. It shows the name and PID of the process listening on that port.

How do I kill a process on a port on a Mac?

Find its PID with lsof, then run `kill <PID>`. If it does not exit, `kill -9 <PID>` ends it immediately.

How do I list all open ports on a Mac?

Run `lsof -nP -iTCP -sTCP:LISTEN` to list listening TCP ports. Add `sudo` to include processes from other users.

What does "address already in use" mean?

Another process is already listening on that port and address. Find it with `lsof -nP -iTCP:<port> -sTCP:LISTEN`, then stop it or pick another port.

Why does lsof show nothing for a port that is in use?

The process may belong to another user or to root. Run the same command with `sudo` in front to include every process.

Is it safe to kill whatever is on port 5000 or 7000?

Not without checking the name. On recent macOS versions those ports are often used by AirPlay Receiver, which you can turn off in System Settings instead.

Looking for something better than Activity Monitor? See the best Activity Monitor alternatives for Mac, or browse every term in the glossary.