Network and System Commands on OS X

netstat on OS X is not especially convenient. It can show a port’s process ID, but not the program name. To list listening ports:

netstat -anLv

Use lsof to see the program name:

lsof -ni | grep LISTEN

To determine whether a particular port is listening, telnet is preferable because lsof returns nothing for ports you do not have permission to inspect.

Show TCP connections:

lsof -itcp

Show TCP connections over IPv6:

lsof -i6tcp

Show connections for a particular port:

lsof -i:1080

Append grep for more specific connection states. I generally use grep -i to avoid missing results because of letter case.

Sometimes lsof displays a service name such as callbook instead of the port number. Add -P to disable that conversion:

lsof -P -itcp:2000

Trace a process’s system calls

Use dtruss on macOS; the corresponding Linux command is strace. It requires sudo.

dtruss df -h       # run and examine "df -h"
dtruss -p 1871     # examine PID 1871
dtruss -n tar      # examine all processes called "tar"
dtruss -f test.sh  # run test.sh and follow children

The macOS dtrace command corresponds to ltrace on Linux.

Originally published on SegmentFault.