No idea what is listening on port 80 in OS X

macos networking port-forwarding port iptables

76,269

Solution 1

You need to run these commands as root to show other users' processes, for example:

sudo lsof -i ':80'

Mac OS X includes an Apache web server that can be controlled using apachectl as root. It's usually started via launchd, the corresponding configuration file is /System/Library/LaunchAgents/org.apache.httpd.plist. If it's not this Apache running on port 80, it is probably launchd, Apple's implementation of a daemon manager. According to Wikipedia:

When launchd scans through the job plists at boot time it reserves and listens on all of the ports requested by those jobs. If so indicated in the plist by the "OnDemand" key, the daemon is not actually loaded at the time. Rather, launchd will listen on the port, start the daemon when needed, and shut it down when it is not. After a daemon is loaded, launchd will keep track of it and make sure it is running if needed.

Solution 2

Just to make the actual answer clear in case users are searching for this.

launchd scans the /System/Library/LaunchDaemons/ on boot and works out from org.apache.httpd.plist that it when apache is started it needs to forward port 80 onto it.
sudo apachectl start was done
However there was a mistake in the httpd.conf file meaning apache was not started, although this was not reported via the apachectl command.
Launchd decided to listen on port 80 as it thought apache was up.
But the contents of any HTTP request resulted in an immediate close of the connection.
sudo lsof -i :80 yielded no answers
sudo netstat -an | grep LISTEN yielded no answers for port 80
there was no information so far as I could tell in any diagnostic tools that showed that port 80 was in-use or listening.
fixing apache's httpd.conf and restarting apache successfully so httpd was in the ps table, led HTTP requests to be successful.
I was therefore mistaking that I couldn't run apache because there was already something listening on port 80, rather than apache conf itself was the cause

76,269

Author by

geoff

Updated on September 18, 2022

Comments

geoff over 1 year
I'm on OSX Mountain Lion 10.8.3, and I've freshly rebooted my Mac.

I want to start a service (like Apache on port 80), but there is already something going on with port 80:
```
telnet localhost 80

Trying ::1...
Connected to localhost.
Escape character is '^]'.
```
Wait, I hear you say, you can find that with lsof or netstat. Except there is nothing there
```
netstat -an | grep LISTEN | grep '\.80'

*comes back blank*

lsof -i :80 | grep LISTEN

*comes back blank
```
So from what I know about unix systems, I figure this must be a packet forwarding rule then? I.e. packets are being forwarded from inbound port 80 to something else, which is listening on that service.
```
ipfw show

65535 0 0 allow ip from any to any
```
Hmm, nothing unusual there
```
pfctl -s nat

No ALTQ support in kernel
ALTQ related functions disabled
```
Nothing unusual there

My question is, how can I display any packet forwarding rules... On Linux I might just do iptables -L -t NAT, or iptables -L. Or alternatively, can any OSX experts help me diagnose this problem?
- Arjan almost 11 years
  
  Not a direct answer to your interesting question, but: what if you point your browser to http://localhost?
- Nevin Williams almost 11 years
  
  The lsof grep you used would come back blank; port numbers are mapped to /etc/services names. Try lsof -i | grep http...
- Gordon Davisson almost 11 years
  
  Actually, the /etc/services mapping isn't a problem if you use the -i :port format, only if you grep. What will be a problem is that lsof needs root privs to see other users' processes, so you should use sudo lsof -i :80 (and I'd try it without the grep, just to make sure...)
- geoff almost 11 years
  
  Hi all, thanks for the suggestions so far, but hasn't turned up anything - even as root, and without greps, there is nothing listed as actually listening to port 80.
- Arjan almost 11 years
  
  Did you try lsof -i :80 while still connected in that Telnet session? And apart from trying http://localhost/, maybe typing something at that Telnet prompt reveals something...? (Again, I know: even if you figure it out that way, it would not be the answer to your question...)
- Arjan almost 11 years
  
  Maybe related: Port is listening, but owned by no one.
Arjan almost 11 years

So then I guess my idea was right that sudo lsof -i ':80' might not actually return anything, unless one runs that while connected in the Telnet session? But even without those commands, http://localhost/ would probably still have shown some Apache welcome page?
Arjan almost 11 years

(I believe your answer is probably the solution; it just doesn't match all comments from the OP.)
geoff almost 11 years

Thanks for this brilliant answer. I've now managed to solve it: 1. There was a mistake in httpd.conf, so sudo apachectl start was not starting apache. 2. But launchd was listening on port 80, ready to forward requests to a non-existent server. 3. However launchd wasn't listening in the conventional sense - that is - the results of sudo lsof -i :80 was blank, likewise for netstat 4. I guess launchd does some magic like xinetd in that it doesn't officially listen on a port, but somehow manages to allow connections to the port by bribing the kernel.
MikeiLL almost 7 years

For me what solved the issue was running sudo apachectl stop in the terminal.
Drew Angell almost 7 years

So what was wrong with httpd.conf? I'm having this problem now and I'm not sure how to proceed based on your answer here..??
RoboBear over 5 years

This did not work for me, but this version did show what was running (OS High Sierra 10.13.6) sudo lsof -i -P | grep -i "80" from superuser.com/questions/984919/…