Earlier in the week we wanted to check which ports were being listened on and by what processes which we can do with the following command on Mac OS X:
$ lsof -ni | grep LISTEN idea 2398 markhneedham 58u IPv6 0xac8f13f77b903331 0t0 TCP *:49410 (LISTEN) idea 2398 markhneedham 65u IPv6 0xac8f13f7799a4af1 0t0 TCP *:58741 (LISTEN) idea 2398 markhneedham 122u IPv6 0xac8f13f7799a4711 0t0 TCP 127.0.0.1:6942 (LISTEN) idea 2398 markhneedham 249u IPv6 0xac8f13f777586711 0t0 TCP *:63342 (LISTEN) idea 2398 markhneedham 253u IPv6 0xac8f13f777586331 0t0 TCP 127.0.0.1:63342 (LISTEN) java 16973 markhneedham 152u IPv6 0xac8f13f777586af1 0t0 TCP *:56471 (LISTEN) java 16973 markhneedham 154u IPv6 0xac8f13f779e6b711 0t0 TCP *:menandmice-dns (LISTEN) java 16973 markhneedham 168u IPv6 0xac8f13f77b902f51 0t0 TCP 127.0.0.1:7474 (LISTEN) java 16973 markhneedham 171u IPv6 0xac8f13f77b013711 0t0 TCP 127.0.0.1:7473 (LISTEN)
One of the interesting things about this output is that for the most part it shows the port number and which IPs it will accept a connection from but sometimes it uses a socket/port alias.
In this case we can see that the 3rd last line refers to ‘menandmice-dns’ but others could be ‘http-alt’ or ‘mysql’.
We can find out what port those names refer to by looking in /etc/services:
$ cat /etc/services | grep menandmice-dns menandmice-dns 1337/udp # menandmice DNS menandmice-dns 1337/tcp # menandmice DNS
$ cat /etc/services | grep http-alt http-alt 591/udp # FileMaker, Inc. - HTTP Alternate (see Port 80) http-alt 591/tcp # FileMaker, Inc. - HTTP Alternate (see Port 80) http-alt 8008/udp # HTTP Alternate http-alt 8008/tcp # HTTP Alternate http-alt 8080/udp # HTTP Alternate (see port 80) http-alt 8080/tcp # HTTP Alternate (see port 80)
There’s a massive XML document on the IANA website with a full list of the port assignments which is presumably where /etc/services is derived from.