How to Find Which Process Is Using a Port on a Mac Using Terminal

When an app cannot start because a port is already in use, Terminal can show which process owns that port. The most useful command is lsof, which lists open files—including network connections—and identifies the process using a specific port.

Quick Answer

1. Open Terminal from Applications > Utilities.
2. Run the following command, replacing 8080 with the port number you want to check:

lsof -nP -iTCP:8080 -sTCP:LISTEN

3. Read the COMMAND, PID, and USER columns:
   – COMMAND is the process name.
   – PID is the process ID.
   – USER is the account running it.

If the command returns no output, no TCP process is currently listening on that port. If you need to stop the process, first verify that it is safe to do so, then use its PID with kill.

Find a Process Listening on a Specific TCP Port

A port is a numbered endpoint that applications use to communicate over a network. A web server, development tool, database, or other service may listen for connections on a particular port. Only one process can normally listen on the same network address and port combination at a time.

1. Open Terminal

Open Finder, select Applications in the sidebar, open the Utilities folder, and double-click Terminal.

You can also press Command-Space, type Terminal, and press Return.

2. Check the port with lsof

Run this command, replacing 8080 with the port you want to investigate:

lsof -nP -iTCP:8080 -sTCP:LISTEN

This command does not change system settings or stop anything. It only asks macOS to list processes that are listening for TCP connections on port 8080.

The options mean:

• lsof lists open files and resources, including network sockets.
• -n prevents hostname lookups, which usually makes the result faster and keeps addresses numeric.
• -P displays port numbers instead of translating them into service names.
• -iTCP:8080 limits the search to TCP port 8080.
• -sTCP:LISTEN shows only TCP sockets in the listening state.

A result may include headings such as:

COMMAND   PID   USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME

The important fields are usually COMMAND, PID, and USER. The process name identifies the application or service, while the PID is the number you can use to inspect or stop that process.

Do not assume that a process should be stopped solely because it appears in the result. System services and development tools may be using the port intentionally.

Check a UDP Port

The previous command checks TCP. Some applications use UDP instead, so use a UDP query when you know the service communicates over UDP:

lsof -nP -iUDP:8080

This command only reports information; it does not close the connection or change the process. Replace 8080 with the UDP port you want to inspect.

TCP and UDP are separate protocols. A TCP listener on a port does not necessarily explain a UDP conflict on the same port, so use the protocol that matches the application or error message.

Check Both TCP and UDP

If you do not know which protocol is involved, query both:

lsof -nP -i:8080

This searches for network resources associated with port 8080 without restricting the result to TCP or UDP. It can return listening sockets as well as other network connections.

To see the complete command-line arguments for a process after finding its PID, use ps:

ps -p 1234 -o pid,ppid,user,comm,args

Replace 1234 with the actual PID from your lsof result. This command also only displays information. It can help distinguish between two processes with similar names, such as multiple instances of a runtime or server.

Understand the lsof Result

A typical lsof result uses columns similar to these:

• COMMAND: The executable or process name.
• PID: The process identification number.
• USER: The macOS account running the process.
• FD: The file descriptor used by the process. A value such as LISTEN may indicate the socket’s role.
• TYPE: The network type, such as IPv4 or IPv6.
• NAME: The address and port associated with the socket.

The exact values depend on the process and the port you query. Focus first on the process name and PID. If the process name is unfamiliar, inspect it before taking action:

ps -p 1234 -o pid,ppid,user,comm,args

You can also check whether the PID still exists:

kill -0 1234

Replace 1234 with the PID you found. This sends no termination signal. It only checks whether the process can be identified and whether your account has permission to signal it. A successful check produces no normal output; an error indicates that the process may not exist or that you lack permission.

Stop the Process Using the Port

Stopping a process can close an app, interrupt a server, disconnect users, or cause unsaved work to be lost. Save your work and quit the related app normally before using a termination command.

If the process belongs to an app you recognize, quit that app first. If it does not close, you can request a normal termination with kill:

kill 1234

Replace 1234 with the correct PID. This asks the process to exit cleanly. It does not change files or uninstall the app, but the app may close and any unsaved work could be lost.

After a few seconds, check the port again:

lsof -nP -iTCP:8080 -sTCP:LISTEN

If there is no output, the TCP listener has stopped. If the process remains, confirm that the PID still belongs to the same service before taking further action.

Force-quit a process only as a last resort

If a process will not respond to a normal termination request, you can send a stronger signal:

kill -9 1234

This immediately terminates the process and gives it no opportunity to clean up. It can result in lost data, incomplete files, or an interrupted operation. Use it only after trying to quit the application normally and using a regular kill command.

Do not use kill -9 on an unfamiliar system process unless you understand the consequences. If the process restarts automatically, force-quitting it may not solve the underlying problem.

Find a Process When You Know Only Part of the Port Information

If you know the port but not the protocol, use:

lsof -nP -i:3000

If you want to search several related ports, run separate commands so each result is clear:

lsof -nP -iTCP:3000 -sTCP:LISTEN
lsof -nP -iTCP:3001 -sTCP:LISTEN
lsof -nP -iTCP:8000 -sTCP:LISTEN

These commands do not modify processes. They only report listeners on the specified TCP ports.

You can also search all listening TCP sockets:

lsof -nP -iTCP -sTCP:LISTEN

This may produce a long list. Use it when you are unsure which port a service uses, then look through the NAME column for the port number.

Use sudo When Permission Is Required

Some processes cannot be fully displayed to a regular user. If the first command produces a permission-related error or omits a process you expect to see, repeat it with sudo:

sudo lsof -nP -iTCP:8080 -sTCP:LISTEN

Terminal will ask for your macOS account password. When you type it, the cursor may not move and no characters will appear. Press Return when finished.

This command still only reads process and network information. However, sudo runs the command with elevated privileges, so check the command carefully before entering your password. Use sudo only when necessary.

If the command reports that lsof cannot be found, check that you typed it correctly. lsof is a standard command-line tool on macOS, but changing your shell environment or installing replacements is unnecessary for this basic check.

Troubleshooting

The command returns no output

No output usually means that no matching process is listening at that moment. Check the following:

1. Confirm the port number.
2. Confirm whether the app uses TCP or UDP.
3. Start the app or service, then run the command again.
4. Try the protocol-neutral command:

lsof -nP -i:8080

A service may bind only to a particular address, use a different port, or stop before you run the check.

The app says the port is busy, but lsof finds nothing

The conflict may be temporary, or the application may be reporting a configuration issue rather than an active listener. Restart the app and repeat the check. If the app recently closed, wait briefly before trying again.

Also check whether the error names a different port than the one you searched. Copy the exact number from the error message rather than relying on a default port.

You found a process, but kill does not work

The process may belong to another user or require administrator permission. Confirm the PID again:

ps -p 1234 -o pid,ppid,user,comm,args

If it is the correct process and you understand the effect of stopping it, use:

sudo kill 1234

This may close the process without warning. Do not use administrator privileges to stop an unknown system service.

The process comes back after you stop it

An app, login item, background service, or development tool may be configured to restart it. Stop the parent application or service through its normal controls instead of repeatedly killing the child process.

To see the parent process ID, run:

ps -p 1234 -o pid,ppid,user,comm,args

The PPID value identifies the parent process. Investigate that parent before changing anything. Avoid deleting launch configuration files or disabling services unless you know exactly what they control.

Frequently Asked Questions

What is the fastest command to find what uses a port on a Mac?

Use lsof with the port number:

lsof -nP -i:8080

Replace 8080 with the port you need to check.

How do I find only a TCP listener?

Run:

lsof -nP -iTCP:8080 -sTCP:LISTEN

This excludes unrelated TCP connections and focuses on processes listening on that port.

Can I identify the app from the PID?

Yes. Use the PID with ps:

ps -p 1234 -o pid,ppid,user,comm,args

The command displays the executable name and its arguments, which often reveal the app or service that started it.

Is it safe to use kill?

kill can close the process and interrupt its work. Save data and quit the related app normally first. Use a regular kill before considering the more forceful kill -9.

Why does Terminal ask for my password?

Some processes are protected or owned by another user. sudo temporarily runs a command with administrator privileges. Use it only for a command you understand, and remember that Terminal does not display password characters as you type.

Final Thoughts

Use lsof -nP -i:PORT to identify processes associated with a port, or add -iTCP and -sTCP:LISTEN when you need to find a specific TCP listener. Check the process name and PID carefully before stopping anything, and prefer quitting the related app normally over forcing a process to close.