Port 445: What's Using It and Is It Safe to Close?

Port 445 carries SMB, the protocol for network file sharing. On a Mac it’s open when File Sharing is turned on, and it’s also used when you connect to a shared drive. It has a notable security history, so it’s worth understanding.

What typically listens on port 445

• macOS File Sharing: Enabling System Settings > General > Sharing > File Sharing starts an SMB server on 445 so other devices can mount your shared folders.
• Connecting to network drives: Mounting a NAS or a Windows share opens an outbound 445 connection.
• Windows interop: 445 is the standard Windows file-sharing port, so Mac-to-PC sharing relies on it.

Is it safe to close?

Closing 445 is safe. Nothing in macOS depends on it except File Sharing itself. If you don’t share folders over the network, turn the feature off:

System Settings > General > Sharing > File Sharing (off).

That’s cleaner than killing a process, since the sharing service is system-managed and would otherwise restart.

Is it suspicious?

This is the port where “is it suspicious” actually matters. SMB has been the entry point for major malware: the EternalBlue exploit and WannaCry ransomware both targeted it. On your own trusted network with File Sharing you deliberately enabled, an open 445 is fine. What you never want is 445 reachable from the public internet, or listening when you never turned on File Sharing. If you see it open and don’t share files, check Sharing settings and close it.

How to find what’s on port 445 on macOS

lsof -i :445

To confirm whether File Sharing is the source, check Sharing settings rather than killing the process. macOS runs SMB through a system service, so disabling the feature is the right way to close the port.

Portie shows port 445 and the process behind it in its live list, and its remote scanner can check whether 445 is open on another host, useful for confirming a machine isn’t exposing SMB it shouldn’t.