netstat on Mac: -tulpn Exits 0 and Shows No TCP Ports

On the Mac mini that runs this business, the Linux habit netstat -tulpn printed one warning, exited 0, and then dumped 311 lines without a single TCP port in them. Every line was a UNIX domain socket. Drop the p and netstat -tuln is worse: no warning at all, exit 0, and the same 311 lines of the wrong thing. A script that checks the exit code would carry on happily.

The usual fix people reach for is lsof, and that one fails more quietly still. Without sudo, lsof -iTCP -sTCP:LISTEN showed 6 of the 16 listening sockets on this machine. Port 22 and port 5900 weren't in the list, and asking about them directly returned nothing with exit 1, which is exactly what "nothing is listening" looks like. Python trying to bind 5900 on the same machine got Address already in use.

"netstat mac" gets 92 Google autocomplete completions, and the biggest clusters are "listening ports", "show process" and "process id". Below is what each Linux flag does on macOS 26, why the two Stack Overflow threads that answer this question (7.2 million views between them) mostly hand you the 6-socket view, and a shell function that lists all 16 with their owners and needs no sudo.

Why netstat -tulpn lists UNIX sockets on a Mac

macOS ships the BSD netstat, and the letters mean different things. I read the option handling in Apple's published netstat main.c and checked each flag by running it:

Flag	Linux netstat	macOS 26 netstat
-t	TCP sockets	Sets an interface-display flag; does nothing to the socket list
-u	UDP sockets	Sets the address family to AF_UNIX (not in the man page)
-l	Listening sockets only	Print full IPv6 addresses
-p	Show PID and program	Takes an argument: the protocol name
-n	Numeric addresses	Numeric addresses (the one that matches)

So -tulpn parses as -t -u -l -p n. "n" isn't a protocol, so netstat warns and jumps to the end of its argument parser. But the jump leaves the return value at 0, and main() only aborts on -2, so it goes on to print sockets for the family that -u already chose: UNIX.

$ netstat -tulpn; echo "exit=$?"
netstat: n: unknown or uninstrumented protocol: Undefined error: 0
Active LOCAL (UNIX) domain sockets
Address          Type   Recv-Q Send-Q   Inode   Conn   Refs  Nextref Addr
...                                     (311 lines)
exit=0

$ netstat -ntlp
netstat: option requires an argument -- p      (exit 64)
$ netstat -ano
netstat: illegal option -- o                   (exit 64)
$ ss -tlnp
zsh: command not found: ss

The order of letters decides whether you get an error. With p last, getopt runs out of characters and complains. With p anywhere else, it eats the next letter as a protocol name. The man page on this machine is dated June 15, 2001 and doesn't mention -u at all.

The lsof answer that hides 10 of 16 sockets

Here is every TCP socket in LISTEN state on this Mac at about 15:00 KST on 2026-10-04, and whether lsof run as my normal user could see it:

Port	Process (owner)	Sockets	lsof without sudo
22	launchd (root), Remote Login	2	Missing
5900	launchd (root), Screen Sharing	2	Missing
88	kdc (root)	2	Missing
38211, 40277, 49174	Tailscale network extension (root)	3	Missing
49182	symptomsd (_networkd)	1	Missing
55322	rapportd (me)	2	Shown
6768, 49172	Orca (me)	2	Shown
8384, 22000	syncthing (me)	2	Shown

The rule is ownership, not port number. lsof without root reports the sockets of processes you own, and four of the ten missing ones sit above port 1023. That matters because the accepted answer on "Who is listening on a given TCP port on Mac OS X?" (2.0 million views, 3,409 votes) says sudo "may not be needed if you need information on ports above 1023". The comment under it with 179 votes has the right rule ("processes you don't own"); a 3-vote comment repeats the port version.

I pulled all 59 answers on that question and on "Find (and kill) processes listening to port 3000 on Mac" (5.2 million views) through the Stack Exchange API. 32 give an lsof command with no sudo in front of lsof, 9 put sudo in front, 5 mention netstat -v, and 15 use something else (npx kill-port, fkill, killall, a Rails pid file). Only one answer body, with 83 votes, says the invisible process probably belongs to another account. To be fair to the 32, the second question is about a dev server on port 3000, which you started yourself, and lsof finds those fine. It's the same question asked about sshd, a VPN or anything launchd owns where the habit breaks.

netstat -anv now prints the process name and PID

The fix was in the netstat answers all along, though their parsing advice has gone stale. With -v, netstat on macOS 26 adds a process:pid column, and it shows root-owned sockets to a normal user:

$ netstat -anv -p tcp | grep LISTEN
tcp4  0  0  *.22    *.*  LISTEN  0  0  131072  131072  launchd:1  ...
tcp4  0  0  127.0.0.1.8384  *.*  LISTEN  0  0  131072  131072  syncthing:1387  ...
tcp6  0  0  *.38211 *.*  LISTEN  0  0  131072  131072  io.tailscale.ipn:994  ...

Apple's source drops show when that changed. The network_cmds-705.100.5 tag from April 2025 prints bare pid and epid columns; network_cmds-726, tagged in October 2025, is the first with process:pid. The name is cut at 16 characters, which is why Tailscale shows up as io.tailscale.ipn and Chrome's helper as Google Chrome He.

Three things in the older answers no longer work on this layout. The 2015 and 2018 answers (57 and 41 votes) say the PID is "the number before the last column"; on macOS 26 that column is rtncnt, and it read 0 on every row. An awk snippet that takes $9 as the PID returned 131072, the receive buffer size, for all 16. And egrep -w '[.]22.*LISTEN' matched syncthing's port 22000 as well as port 22.

A ports function that needs no sudo

This is the function I now use. It reads the macOS 26 layout, finds the field ending in :digits rather than counting columns (process names can contain spaces), collapses the IPv4 and IPv6 copies of each socket, and looks up the full name with ps, which also works across users without root:

# ports [PORT]: who is listening on TCP, no sudo needed (macOS 26 netstat -anv)
ports() {
  local rows
  rows=$(netstat -anv -p tcp | awk -v want="$1" '
    $6 == "LISTEN" {
      port = $4; sub(/.*[.]/, "", port)
      if (want != "" && port != want) next
      pid = ""
      for (i = 11; i <= NF; i++) if ($i ~ /:[0-9]+$/) { pid = $i; sub(/.*:/, "", pid); break }
      if ((port, pid) in seen) next
      seen[port, pid] = 1; n++
      addr = $4; sub(/[.][^.]*$/, "", addr)
      print port, addr, pid
    }
    END { exit n == 0 }') || return 1
  printf '%s\n' "$rows" | sort -n | while read -r port addr pid; do
    name=$(ps -o comm= -p "$pid" 2>/dev/null)
    printf '%-6s %-10s %-6s %s\n' "$port" "$addr" "$pid" "${name##*/}"
  done
}

$ ports 5900
5900   *          1      launchd
$ ports 9999; echo "exit=$?"
exit=1

On this machine it lists 13 port and process pairs in 0.03 seconds and returns 1 when nothing is listening, so if ports 8080; then works in a script. I tested it in zsh, the stock bash 3.2 and /bin/sh, and against a throwaway python3 -m http.server on port 8765, which showed up with its PID. On a macOS release from before the process:pid column the PID field won't match and the function prints nothing useful; there, sudo lsof -nP -iTCP -sTCP:LISTEN is the answer.

This is the same pattern as pstree on Mac, where the name exists but the flags mean something else, and lsusb on Mac, where the usual substitute prints nothing and exits 0. The same lsof I trust here is how I counted descriptors in the too many open files limit on Mac, which worked only because those were my own processes. Port 22 is what keeps this machine reachable at all, as I covered in KVM over IP for a Mac mini; a check that reports it as free is a check I don't want in a script.

FAQ

What is the netstat -tulpn equivalent on Mac?

Run netstat -anv -p tcp | grep LISTEN for TCP and netstat -anv -p udp for UDP. On macOS 26 the -v output includes a process:pid column for every socket, including ones owned by root, without sudo. netstat -tulpn itself exits 0 but lists UNIX domain sockets, because -u means AF_UNIX and -p takes a protocol name on macOS.

How do I see which process is using a port on Mac?

Use sudo lsof -nP -iTCP:PORT -sTCP:LISTEN, or without sudo on macOS 26, netstat -anv -p tcp | grep LISTEN and read the process:pid column. Plain lsof -i :PORT without sudo only finds processes you own, so it misses services such as Remote Login on port 22.

Why does lsof show nothing for a port that is in use?

lsof without root only reports sockets of processes owned by your user. On a Mac mini running macOS 26.4.1 it returned no output and exit 1 for ports 22, 5900 and 88, all held by root processes, while binding those ports failed with Address already in use. Run it with sudo, or use netstat -anv, which shows every owner.

Method: every command ran on 2026-10-04 between about 15:00 and 15:30 KST on a Mac mini M4 (Mac16,10, macOS 26.4.1 build 25E253) as a normal user. This machine has no passwordless sudo, so I did not run sudo lsof; the claim that sudo lsof shows every owner comes from the answers and comments quoted above, not from a run of mine. The 59 answers are all answers to Stack Overflow questions 4421633 and 3855127 as returned by the Stack Exchange API that day, classified by whether the lsof command in each carries sudo; vote and view counts are from the same call. Flag behavior comes from running each flag and reading main.c in Apple's network_cmds repository at its current main branch and at the network_cmds-705.100.5 tag. I did not test macOS 15 or earlier, an Intel Mac, or UDP parsing in the function.