Port Reference: What's Using Each Port and Is It Safe to Kill?
Look up any TCP or UDP port number: what typically listens on it, what that service does, whether it's safe to close, and how to find it on your Mac.
A port number tells your Mac which process should receive a piece of network traffic. When you spot an unfamiliar port in a monitor, a firewall log, or an “address already in use” error, the question is always the same: what is that, and can I close it?
This reference answers it in one place. Every port below lists what normally listens on it, what that service does, and the exact command to find and free it on macOS. The table jumps you straight to the one you care about.
How port numbers are organized
IANA splits the 0-65535 range into three bands:
- Well-known ports (0-1023): Core services like HTTP (
80), HTTPS (443), and SSH (22). Binding one requires admin privileges. - Registered ports (1024-49151): Assigned to specific applications such as MySQL (
3306) or PostgreSQL (5432), but any process can bind them. - Dynamic / ephemeral ports (49152-65535): Handed out automatically for outgoing connections. Seeing many of these is normal.
For the full categorized table, see Common ports and what they’re used for. If a dev server won’t start because the port is taken, the port already in use guide covers the fix.
Find what’s on a port in two seconds
Every entry above shows the manual lsof command. If you’d rather see every open port and its owning app in one window, Portie lists them live and lets you kill a process without touching Terminal.
If a port is blocking you right now
- Address already in use on Mac explains what EADDRINUSE actually means and how to stop it recurring, not just how to free the port once.
- Kill a process on a port covers finding the PID and freeing the port, including the macOS services that relaunch themselves.
- Which app is using a port translates the process names
lsofreports into the apps they belong to. - List every open port shows the full picture, and why the obvious command is slower than it needs to be.
- Port 5000 in use is almost always AirPlay Receiver on a modern Mac.
Quick reference
| Port | Protocol | Typical service |
|---|---|---|
| 21 | TCP | FTP, legacy file transfer |
| 22 | TCP | SSH and SFTP (secure remote login) Common on macOS |
| 25 | TCP | SMTP (mail transfer) |
| 53 | TCP/UDP | DNS (domain name resolution) |
| 80 | TCP | HTTP, unencrypted web traffic |
| 137 | UDP | NetBIOS name service (legacy Windows networking) |
| 443 | TCP | HTTPS, encrypted web traffic |
| 445 | TCP | SMB network file sharing Common on macOS |
| 631 | TCP | CUPS (macOS printing system) Common on macOS |
| 1433 | TCP | Microsoft SQL Server |
| 1900 | UDP | SSDP / UPnP device discovery |
| 2375 | TCP | Docker daemon API (unencrypted) |
| 3000 | TCP | Node.js, React, Rails dev servers |
| 3001 | TCP | Node.js/React dev server fallback, Rails API |
| 3306 | TCP | MySQL / MariaDB database |
| 3389 | TCP | Remote Desktop Protocol (RDP) |
| 4200 | TCP | Angular CLI dev server |
| 5000 | TCP | macOS AirPlay Receiver, Flask dev server Common on macOS |
| 5001 | TCP | Synology DSM (HTTPS), Flask/Node dev server fallback |
| 5173 | TCP | Vite dev server |
| 5353 | UDP | mDNS / Bonjour (local network discovery) Common on macOS |
| 5432 | TCP | PostgreSQL database |
| 5900 | TCP | VNC / macOS Screen Sharing Common on macOS |
| 6379 | TCP | Redis in-memory store |
| 6443 | TCP | Kubernetes API server |
| 7000 | TCP | macOS AirPlay Receiver, Cassandra Common on macOS |
| 8000 | TCP | Django, Python http.server, dev servers |
| 8009 | TCP | Apache Tomcat AJP connector |
| 8080 | TCP | HTTP alternate, dev servers, proxies |
| 8443 | TCP | HTTPS alternate, dev and admin consoles |
| 8888 | TCP | Jupyter Notebook |
| 9000 | TCP | php-fpm, SonarQube, MinIO, and others |
| 9200 | TCP | Elasticsearch HTTP API |
| 11434 | TCP | Ollama local LLM server |
| 17500 | TCP | Dropbox LAN Sync discovery Common on macOS |
| 25565 | TCP | Minecraft server |
| 27017 | TCP | MongoDB database |
| 49152 | TCP | Start of the ephemeral / dynamic port range Common on macOS |
| 62078 | TCP | lockdownd / usbmux (iOS device sync) Common on macOS |
Port by port
Port 21 FTP, legacy file transfer
Port 21 is the control port for FTP, the File Transfer Protocol. It's a legacy protocol, and modern macOS doesn't run an FTP server by default. A listener on 21 means FTP software you installed.
Find what is using it:
sudo lsof -i :21Port 22 SSH and SFTP (secure remote login)
Port 22 is the standard port for SSH, the protocol for encrypted remote login and secure file transfer (SFTP runs over it too). On a Mac, port 22 is only listening if you've turned on Remote Login.
Find what is using it:
sudo lsof -i :22Port 25 SMTP (mail transfer)
Port 25 is the original SMTP port, used for server-to-server mail transfer since the early internet. If you're trying to send mail from a script, a self-hosted app, or a mail server and it's timing out on port 25, the port almost certainly isn't the problem on your end; it's being blocked upstream.
Find what is using it:
sudo lsof -i :25Port 53 DNS (domain name resolution)
Port 53 is DNS, the service that turns domain names into IP addresses. Your Mac sends DNS queries constantly, but that's outbound traffic. A process actually listening on port 53 is less common than you might expect, and on a stock Mac there usually isn't one.
Find what is using it:
sudo lsof -i :53Port 80 HTTP, unencrypted web traffic
Port 80 is the default port for HTTP, unencrypted web traffic. Modern browsers now try HTTPS on 443 first for a typed address, but plenty of traffic still reaches 80 through explicit http:// links and server redirects. A process listening on 80 on your Mac means a local web server.
Find what is using it:
sudo lsof -i :80Port 137 NetBIOS name service (legacy Windows networking)
Port 137 is the NetBIOS Name Service, part of the older Windows networking stack used to resolve computer names on a local network. It predates modern SMB and shows up mostly around legacy Windows file sharing.
Find what is using it:
sudo lsof -i :137Port 443 HTTPS, encrypted web traffic
Port 443 is HTTPS, the encrypted version of web traffic. It's the busiest port on the internet: almost every secure website you load travels over it. On your Mac, the question is usually whether something is listening on 443 locally, which means a web server.
Find what is using it:
sudo lsof -i :443Port 445 SMB network file sharing
Port 445 carries SMB, the protocol for network file sharing. On a Mac it's open when File Sharing is turned on, and it's also used when you connect to a shared drive. It has a notable security history, so it's worth understanding.
Find what is using it:
sudo lsof -i :445Port 631 CUPS (macOS printing system)
Port 631 is one you'll see open on essentially every Mac, and it's not a mystery once you know what it is: it's CUPS, the printing system Apple has used since OS X.
Find what is using it:
sudo lsof -i :631Port 1433 Microsoft SQL Server
Port 1433 is the default port for Microsoft SQL Server. On a Mac, you're most likely seeing it because you run SQL Server in a Docker container for development, since there's no native macOS build.
Find what is using it:
sudo lsof -i :1433Port 1900 SSDP / UPnP device discovery
Port 1900 isn't a service you install; it's UDP traffic from SSDP, the discovery protocol behind "cast to this device" and "browse this media server" features.
Find what is using it:
sudo lsof -i :1900Port 2375 Docker daemon API (unencrypted)
Port 2375 is the Docker daemon's remote API over unencrypted HTTP. It exists so other machines can control Docker, but because it has no encryption or authentication, an open 2375 is one of the more dangerous things you can have listening.
Find what is using it:
sudo lsof -i :2375Port 3000 Node.js, React, Rails dev servers
Port 3000 is the default port for a long list of development servers. If something on your Mac is using it, that something is almost always a local web app you started.
Find what is using it:
sudo lsof -i :3000Port 3001 Node.js/React dev server fallback, Rails API
Port 3001 shows up constantly in local development, almost always for one reason: something wanted port 3000 and it was already taken.
Find what is using it:
sudo lsof -i :3001Port 3306 MySQL / MariaDB database
Port 3306 is the default port for MySQL and MariaDB. If it's in use on your Mac, you have a database server running, usually a local one you installed for development.
Find what is using it:
sudo lsof -i :3306Port 3389 Remote Desktop Protocol (RDP)
Port 3389 is the Remote Desktop Protocol (RDP) port, used to control Windows machines remotely. Seeing it on a Mac is unusual and almost always tied to virtualization or remote-desktop software.
Find what is using it:
sudo lsof -i :3389Port 4200 Angular CLI dev server
Port 4200 is the default port for the Angular CLI dev server. A listener on 4200 is almost always ng serve running a local Angular project.
Find what is using it:
sudo lsof -i :4200Port 5000 macOS AirPlay Receiver, Flask dev server
Port 5000 is the classic macOS conflict. You start a Flask app, it fails because the port is already taken, and you swear you didn't start anything. On modern macOS, you didn't: the system itself is using it.
Find what is using it:
sudo lsof -i :5000Port 5001 Synology DSM (HTTPS), Flask/Node dev server fallback
Port 5001 usually means one of two things. On a Synology NAS it's the HTTPS port for DSM, the web admin interface. On a Mac doing local development it's the common fallback for a Flask or Node dev server when port 5000 is already taken by AirPlay Receiver. Checking the process name tells you which one you have.
Find what is using it:
sudo lsof -i :5001Port 5173 Vite dev server
Port 5173 is the default port for Vite, the fast build tool used by modern Vue, React, Svelte, and other front-end projects. A listener on 5173 is almost always a Vite dev server you started.
Find what is using it:
sudo lsof -i :5173Port 5353 mDNS / Bonjour (local network discovery)
Port 5353 is the multicast DNS (mDNS) port, the foundation of Apple's Bonjour. It's how your Mac finds printers, AirPlay targets, and other devices on the local network without any manual configuration. On macOS, 5353 is essentially always in use.
Find what is using it:
sudo lsof -i :5353Port 5432 PostgreSQL database
Port 5432 is the default port for PostgreSQL. If it's in use on your Mac, you have a Postgres server running, almost always a local one for development.
Find what is using it:
sudo lsof -i :5432Port 5900 VNC / macOS Screen Sharing
Port 5900 is the standard VNC port, used for remote screen viewing and control. On a Mac, it's how Screen Sharing works, so a listener on 5900 means screen access is enabled.
Find what is using it:
sudo lsof -i :5900Port 6379 Redis in-memory store
Port 6379 is the default port for Redis, the in-memory data store often used for caching, sessions, and queues. A listener on 6379 means a local Redis server, almost always one you started for development.
Find what is using it:
sudo lsof -i :6379Port 6443 Kubernetes API server
Port 6443 is the standard port for the Kubernetes API server, the control plane that every kubectl command talks to. On a Mac, a listener on 6443 means a local Kubernetes cluster is running.
Find what is using it:
sudo lsof -i :6443Port 7000 macOS AirPlay Receiver, Cassandra
Port 7000 is the companion to port 5000 in the macOS AirPlay story. On modern macOS it's used by AirPlay Receiver, and it occasionally collides with development tools that also default to 7000.
Find what is using it:
sudo lsof -i :7000Port 8000 Django, Python http.server, dev servers
Port 8000 is one of the most common development server defaults. Django's runserver, Python's built-in http.server, and countless other local tools use it. A listener on 8000 is almost always a dev server you started.
Find what is using it:
sudo lsof -i :8000Port 8009 Apache Tomcat AJP connector
Port 8009 shows up alongside 8080 on any machine running Apache Tomcat, but it does a different job: it's the AJP connector, not the HTTP one.
Find what is using it:
sudo lsof -i :8009Port 8080 HTTP alternate, dev servers, proxies
Port 8080 is the most common alternative HTTP port. If something on your Mac is using it, that something is almost always a web server or proxy you, or a tool you installed, started locally.
Find what is using it:
sudo lsof -i :8080Port 8443 HTTPS alternate, dev and admin consoles
Port 8443 is the HTTPS counterpart to port 8080: a common alternative for encrypted web traffic that doesn't require the admin privileges binding 443 needs. A listener on 8443 is almost always a local server or app.
Find what is using it:
sudo lsof -i :8443Port 8888 Jupyter Notebook
Port 8888 is the default port for Jupyter Notebook and JupyterLab. A listener on 8888 usually means a Jupyter server is running locally.
Find what is using it:
sudo lsof -i :8888Port 9000 php-fpm, SonarQube, MinIO, and others
Port 9000 is a crowded default. Several unrelated tools claim it, so the first job is finding out which one is running. A listener on 9000 is almost always a local service or dev tool.
Find what is using it:
sudo lsof -i :9000Port 9200 Elasticsearch HTTP API
Port 9200 belongs to Elasticsearch, and it's one of the more common "why won't this start" ports for anyone running a local search or logging stack.
Find what is using it:
sudo lsof -i :9200Port 11434 Ollama local LLM server
Port 11434 is the default port for Ollama, the popular tool for running large language models locally. A listener on 11434 means the Ollama server is running on your Mac.
Find what is using it:
sudo lsof -i :11434Port 17500 Dropbox LAN Sync discovery
Port 17500 is Dropbox's LAN Sync discovery port. Dropbox uses it to find other machines on your local network signed into the same account, so files copy directly between them instead of round-tripping through Dropbox's servers. It's open whenever the Dropbox desktop app is running, and closing it only costs you faster local transfers.
Find what is using it:
sudo lsof -i :17500Port 25565 Minecraft server
Port 25565 is the default port for Minecraft: Java Edition servers. A listener on 25565 means you're hosting a Minecraft server on your Mac.
Find what is using it:
sudo lsof -i :25565Port 27017 MongoDB database
Port 27017 is the default port for MongoDB. If it's in use on your Mac, you have a MongoDB server running, almost always a local one for development.
Find what is using it:
sudo lsof -i :27017Port 49152 Start of the ephemeral / dynamic port range
Port 49152 is the first port in the dynamic, or ephemeral, range that runs from 49152 to 65535. Unlike a database or web port, it isn't tied to a particular service. The operating system assigns ports from this range automatically whenever your Mac opens an outgoing connection.
Find what is using it:
sudo lsof -i :49152Port 62078 lockdownd / usbmux (iOS device sync)
Port 62078 is where lockdownd, also called usbmux, listens for iOS device pairing and sync. It's the channel a Mac uses to trust and talk to a connected iPhone or iPad over USB or Wi-Fi, covering Xcode debugging, Finder or iTunes sync, and other tools that need the device unlocked and paired. It's active only while a device is connected, so seeing it open is expected any time an iPhone is plugged in.
Find what is using it:
sudo lsof -i :62078Try Portie Free
See every open port on your Mac, which app owns it, and kill processes from the list.
Download Free