Port Reference: What's Using Each Port and Is It Safe to Kill? on Portie

Port 21: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 21 is the control port for FTP, the File Transfer Protocol. It’s a legacy protocol, and modern macOS doesn’t run an FTP server by default. A listener on 21 means FTP software you installed.

What typically listens on port 21

Third-party FTP servers: Tools you installed to serve files over FTP.
Legacy setups: Older workflows that still use FTP for uploads.

Apple removed the built-in FTP server (ftpd) in macOS High Sierra (10.13), so stock macOS has nothing listening here. FTP uses 21 for commands and a separate data connection for the transfers themselves.

Port 22: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 22 is the standard port for SSH, the protocol for encrypted remote login and secure file transfer (SFTP runs over it too). On a Mac, port 22 is only listening if you’ve turned on Remote Login.

What typically listens on port 22

macOS Remote Login: Enabling System Settings > General > Sharing > Remote Login starts Apple’s built-in sshd on port 22.
Third-party SSH servers: Less common on macOS, but some setups install their own.
SFTP: Secure file transfer uses the same SSH service and port.

Unlike a dev server, this is a real system service managed by launchd.

Port 53: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 53 is DNS, the service that turns domain names into IP addresses. Your Mac sends DNS queries constantly, but that’s outbound traffic. A process actually listening on port 53 is less common than you might expect, and on a stock Mac there usually isn’t one.

What typically listens on port 53

On a default macOS install, nothing listens on 53. DNS resolution is handled by mDNSResponder, the system resolver, but it sends outbound queries and listens on port 5353 for multicast DNS (Bonjour), not on 53. A listener on port 53 shows up when something acts as a local DNS server:

Port 80: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 80 is the default port for HTTP, unencrypted web traffic. Modern browsers now try HTTPS on 443 first for a typed address, but plenty of traffic still reaches 80 through explicit http:// links and server redirects. A process listening on 80 on your Mac means a local web server.

What typically listens on port 80

Local web servers: nginx, Apache, and Caddy use 80 for plain HTTP.
Dev servers: Some local setups serve on 80, though 8080 and 3000 are far more common to avoid needing admin rights.
Redirect servers: A server that catches HTTP and redirects to HTTPS listens on 80.

Port 80 is in the well-known range (0-1023), so binding it requires admin privileges. macOS does not run anything on 80 out of the box.

Port 137: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 137 is the NetBIOS Name Service, part of the older Windows networking stack used to resolve computer names on a local network. It predates modern SMB and shows up mostly around legacy Windows file sharing.

What typically listens on port 137

NetBIOS name resolution: Older Windows networks use 137 (UDP) to map computer names to addresses.
Legacy SMB interop: Connecting to or from older Windows shares can involve 137, alongside 138 and 139.
Network discovery tools: Some scanners and file-sharing tools query it.

On modern networks this is largely replaced by DNS and direct SMB over port 445.

Port 443: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 443 is HTTPS, the encrypted version of web traffic. It’s the busiest port on the internet: almost every secure website you load travels over it. On your Mac, the question is usually whether something is listening on 443 locally, which means a web server.

What typically listens on port 443

Outbound browsing: Every HTTPS page your browser loads connects to port 443 on the remote server. This is normal traffic, not a local listener.
Local web servers: nginx, Apache, and Caddy bind 443 when configured for HTTPS.
Dev servers with TLS: Some local setups serve HTTPS on 443, or on 8443 to avoid needing admin rights.
Proxies: Local reverse proxies terminating TLS listen here.

Binding 443 is in the well-known range (0-1023), so it requires admin privileges.

Port 445: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 445 carries SMB, the protocol for network file sharing. On a Mac it’s open when File Sharing is turned on, and it’s also used when you connect to a shared drive. It has a notable security history, so it’s worth understanding.

What typically listens on port 445

macOS File Sharing: Enabling System Settings > General > Sharing > File Sharing starts an SMB server on 445 so other devices can mount your shared folders.
Connecting to network drives: Mounting a NAS or a Windows share opens an outbound 445 connection.
Windows interop: 445 is the standard Windows file-sharing port, so Mac-to-PC sharing relies on it.

Is it safe to close?

Closing 445 is safe. Nothing in macOS depends on it except File Sharing itself. If you don’t share folders over the network, turn the feature off:

Port 1433: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 1433 is the default port for Microsoft SQL Server. On a Mac, you’re most likely seeing it because you run SQL Server in a Docker container for development, since there’s no native macOS build.

What typically listens on port 1433

SQL Server in Docker: The standard way to run MS SQL on a Mac maps the container’s 1433 to the host.
Remote SQL Server connections: Connecting to a SQL Server on your network uses outbound 1433.
Database tooling: Some clients default to 1433 when connecting to Azure SQL or a local instance.

It sits in the registered range (1024-49151), so any process can bind it.

Port 2375: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 2375 is the Docker daemon’s remote API over unencrypted HTTP. It exists so other machines can control Docker, but because it has no encryption or authentication, an open 2375 is one of the more dangerous things you can have listening.

What typically listens on port 2375

Docker daemon (remote API): Explicitly enabling the TCP socket on 2375 exposes the daemon.
CI and tooling misconfigurations: Some setups open 2375 for convenience, often without realizing the risk.

On a Mac, Docker Desktop normally talks to the daemon over a local Unix socket, not 2375, so this port is usually closed unless something turned it on. The encrypted, authenticated equivalent is 2376.

Port 3000: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 3000 is the default port for a long list of development servers. If something on your Mac is using it, that something is almost always a local web app you started.

What typically listens on port 3000

Node.js apps: Express and many other Node setups default to 3000.
Create React App: The React dev server starts on 3000.
Ruby on Rails: rails server defaults to 3000.
Next.js and others: A wide range of JavaScript frameworks pick 3000 out of the box.

It’s in the registered range (1024-49151), so any app can bind it without admin rights.

Port 3306: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 3306 is the default port for MySQL and MariaDB. If it’s in use on your Mac, you have a database server running, usually a local one you installed for development.

What typically listens on port 3306

MySQL: The default server port since the beginning. Homebrew, the official installer, and Docker images all use it.
MariaDB: MySQL’s drop-in fork shares the same 3306 default.
Bundled stacks: MAMP, XAMPP, and similar dev bundles start MySQL here (MAMP sometimes uses 8889).

By default these bind to 127.0.0.1 only, so the database is reachable from your Mac but not the network.

Port 3389: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 3389 is the Remote Desktop Protocol (RDP) port, used to control Windows machines remotely. Seeing it on a Mac is unusual and almost always tied to virtualization or remote-desktop software.

What typically listens on port 3389

Windows VMs: Parallels, VMware Fusion, or UTM running Windows often expose RDP on 3389.
Microsoft Remote Desktop: The Mac client connects outbound to 3389 on the machine you’re controlling.
RDP server tools: Some cross-platform remote-access apps listen here.

Stock macOS does not open 3389. Apple’s own Screen Sharing and Remote Management use VNC on port 5900 instead.

Port 4200: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 4200 is the default port for the Angular CLI dev server. A listener on 4200 is almost always ng serve running a local Angular project.

What typically listens on port 4200

Angular CLI: ng serve defaults to 4200.
Angular-based tooling: Some Angular project templates and tools reuse it.

It’s in the registered range (1024-49151), so any app can bind it without admin rights.

Is it safe to kill?

Yes. A process on 4200 is a local dev server, not a macOS service. Killing it frees the port and stops that server. Confirm it isn’t one you still need.

Port 5000 in Use on Mac: AirPlay, Flask, and How to Free It

Sat, 06 Jun 2026 00:00:00 +0000

Port 5000 is the classic macOS conflict. You start a Flask app, it fails because the port is already taken, and you swear you didn’t start anything. On modern macOS, you didn’t: the system itself is using it.

What typically listens on port 5000

AirPlay Receiver (macOS Monterey and later): Apple’s AirPlay Receiver, part of the ControlCenter process, binds port 5000 (and 7000) so your Mac can receive AirPlay streams. This is on by default.
Flask: Flask’s development server defaults to 5000, which is exactly why the conflict is so common.
Older Rails and other dev tools: A handful of frameworks also default here.

So a “port 5000 in use” error on a Mac is usually AirPlay, not a leftover server.

Port 5173: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 5173 is the default port for Vite, the fast build tool used by modern Vue, React, Svelte, and other front-end projects. A listener on 5173 is almost always a Vite dev server you started.

What typically listens on port 5173

Vite dev server: npm run dev in a Vite project serves on 5173 by default.
Frameworks built on Vite: Vue, SvelteKit, and many React setups use it.

If 5173 is busy, Vite quietly moves to 5174 and up, which is why you sometimes see your app on a higher port. It’s in the registered range (1024-49151), so any app can bind it without admin rights.

Port 5353: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 5353 is the multicast DNS (mDNS) port, the foundation of Apple’s Bonjour. It’s how your Mac finds printers, AirPlay targets, and other devices on the local network without any manual configuration. On macOS, 5353 is essentially always in use.

What typically listens on port 5353

mDNSResponder: The macOS system service that runs Bonjour. This is the usual and expected owner.
Bonjour-based discovery: Printing, AirPlay, file sharing, and many apps rely on it.
Other mDNS tools: Some cross-platform discovery software also uses 5353.

This is core networking infrastructure, not a stray process.

Port 5432: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 5432 is the default port for PostgreSQL. If it’s in use on your Mac, you have a Postgres server running, almost always a local one for development.

What typically listens on port 5432

PostgreSQL: The default server port. Homebrew’s postgresql formula, Postgres.app, and Docker images all use it.
Docker and dev environments: Containers map Postgres to 5432 on the host.
Connection poolers: Tools like PgBouncer sometimes sit in front, though often on a different port.

By default Postgres binds to 127.0.0.1, so it’s reachable from your Mac but not the network.

Port 5900: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 5900 is the standard VNC port, used for remote screen viewing and control. On a Mac, it’s how Screen Sharing works, so a listener on 5900 means screen access is enabled.

What typically listens on port 5900

macOS Screen Sharing: Enabling System Settings > General > Sharing > Screen Sharing starts a VNC server on 5900.
Remote Management: Apple Remote Desktop uses the same port when Remote Management is on.
Third-party VNC servers: Tools like TightVNC or RealVNC, if installed, listen here.

This is a system-managed service, not a stray process.

Port 6379: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 6379 is the default port for Redis, the in-memory data store often used for caching, sessions, and queues. A listener on 6379 means a local Redis server, almost always one you started for development.

What typically listens on port 6379

Redis: The default redis-server port. Homebrew’s redis formula and Docker images use it.
Docker and dev environments: Containers map Redis to 6379 on the host.

Homebrew’s Redis is configured to bind to localhost, so it’s reachable from your Mac but not the network. That isn’t universal: upstream Redis and most Docker images don’t bind to localhost by default and instead rely on protected mode to refuse unauthenticated remote connections.

Port 6443: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 6443 is the standard port for the Kubernetes API server, the control plane that every kubectl command talks to. On a Mac, a listener on 6443 means a local Kubernetes cluster is running.

What typically listens on port 6443

Docker Desktop Kubernetes: Its built-in cluster exposes the API server on 6443.
minikube, kind, k3s: Local cluster tools run the API server here.
Remote clusters: Connecting to a managed cluster uses outbound 6443.

It’s in the registered range (1024-49151). The API server is supervised by your Kubernetes tooling, not a stray process.

Port 7000: What's Using It and Is It Safe to Close?

Sat, 06 Jun 2026 00:00:00 +0000

Port 7000 is the companion to port 5000 in the macOS AirPlay story. On modern macOS it’s used by AirPlay Receiver, and it occasionally collides with development tools that also default to 7000.

What typically listens on port 7000

AirPlay Receiver (macOS Monterey and later): Apple’s AirPlay Receiver, part of the ControlCenter process, uses 7000 along with 5000 to receive streams. This is on by default.
Apache Cassandra: The database uses 7000 for inter-node communication, so a local Cassandra setup can claim it.
Other dev tools: A handful of services default here.

So on a typical Mac, 7000 in use is AirPlay, not a leftover server.

Port 8000: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 8000 is one of the most common development server defaults. Django’s runserver, Python’s built-in http.server, and countless other local tools use it. A listener on 8000 is almost always a dev server you started.

What typically listens on port 8000

Django: python manage.py runserver defaults to 8000.
Python http.server: python -m http.server serves on 8000.
Other dev tools: Many frameworks and static file servers pick 8000 as a default.

It’s in the registered range (1024-49151), so any app can bind it without admin rights.

Port 8080: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 8080 is the most common alternative HTTP port. If something on your Mac is using it, that something is almost always a web server or proxy you, or a tool you installed, started locally.

What typically listens on port 8080

Port 8080 is not reserved for any single program, which is exactly why so much software defaults to it. The usual suspects:

Development servers: Spring Boot and other Java frameworks, many Node.js setups, and countless “quick start” tutorials use 8080 by default.
Tomcat and Jenkins: Both ship with 8080 as the out-of-the-box port.
HTTP proxies: Local proxy servers and API gateways listen here.
Docker containers: A container publishing a web service often maps it to 8080 on the host.

Because it sits in the registered range (1024-49151), any app can bind it without admin rights.

Port 8443: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 8443 is the HTTPS counterpart to port 8080: a common alternative for encrypted web traffic that doesn’t require the admin privileges binding 443 needs. A listener on 8443 is almost always a local server or app.

What typically listens on port 8443

Tomcat and Java apps: Tomcat’s default SSL connector uses 8443.
Development HTTPS servers: Local setups serving TLS without root often pick 8443.
Admin consoles: Many appliances and tools expose their HTTPS management interface here.
Proxies: Local reverse proxies terminating TLS on a non-privileged port.

Because it’s in the registered range (1024-49151), any app can bind it without admin rights, which is the whole appeal.

Port 8888: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 8888 is the default port for Jupyter Notebook and JupyterLab. A listener on 8888 usually means a Jupyter server is running locally.

What typically listens on port 8888

Jupyter Notebook / JupyterLab: Both default to 8888.
Other data-science tools: A few notebook-style tools reuse it.

If 8888 is taken, Jupyter moves to 8889 and up, which is why you sometimes land on a higher port. It’s in the registered range (1024-49151).

Port 9000: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 9000 is a crowded default. Several unrelated tools claim it, so the first job is finding out which one is running. A listener on 9000 is almost always a local service or dev tool.

What typically listens on port 9000

php-fpm: The PHP FastCGI process manager listens on 9000 by default (some setups use a Unix socket instead).
SonarQube: The code-quality server’s web UI uses 9000.
MinIO: The S3-compatible storage server serves its API on 9000 (its console runs on 9001).
Portainer (older versions): Legacy Portainer used 9000 for its UI; current versions default to 9443 for HTTPS.
Xdebug 2: Used 9000, but Xdebug 3 moved its default to 9003 specifically to stop clashing with php-fpm.

Because so many tools pick 9000, conflicts are common. It’s in the registered range (1024-49151), so any app can bind it.

Port 11434: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 11434 is the default port for Ollama, the popular tool for running large language models locally. A listener on 11434 means the Ollama server is running on your Mac.

What typically listens on port 11434

Ollama: The local model server binds 11434 to accept API requests from apps and the command line.
Ollama front-ends: UIs and tools that talk to Ollama connect to this port.

It’s in the registered range (1024-49151), so it binds without admin rights. Ollama keeps the server running in the background so models load on demand.

Port 25565: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 25565 is the default port for Minecraft: Java Edition servers. A listener on 25565 means you’re hosting a Minecraft server on your Mac.

What typically listens on port 25565

Minecraft Java server: The official server and forks like Paper and Spigot default to 25565.
Server managers: Tools that launch Minecraft servers use the same port.

It’s in the registered range (1024-49151), so it binds without admin rights. Bedrock Edition uses a different port (19132 over UDP).

Port 27017: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 27017 is the default port for MongoDB. If it’s in use on your Mac, you have a MongoDB server running, almost always a local one for development.

What typically listens on port 27017

MongoDB: The default mongod server port. Homebrew’s mongodb-community formula and Docker images use it.
Docker and dev environments: Containers map MongoDB to 27017 on the host.

A local MongoDB install binds to 127.0.0.1 by default, so it’s reachable from your Mac but not the network. Docker is the exception: the official image listens on all interfaces inside the container, so what matters is how you publish the port. Map it to 127.0.0.1 if you don’t want it exposed.

Port 49152: What's Using It and Is It Safe to Kill?

Sat, 06 Jun 2026 00:00:00 +0000

Port 49152 is the first port in the dynamic, or ephemeral, range that runs from 49152 to 65535. Unlike a database or web port, it isn’t tied to a particular service. The operating system assigns ports from this range automatically whenever your Mac opens an outgoing connection.

What typically uses port 49152

Outgoing connections: Apps that connect out (browsers, sync clients, anything talking to a server) get a temporary local port from this range.
Temporary listeners: Some software opens a short-lived listener on a dynamic port for peer-to-peer transfers or local IPC.

Because assignment is automatic, the exact port varies from one connection to the next. Seeing 49152, or any high number, in use is part of normal networking. For more on the ranges, see Common ports and what they’re used for.