What Is a Socket?

The socket API (from BSD Unix, which macOS inherits) gives programs a handful of operations:

• A server creates a socket, binds it to an address and port (say *:443), and listens. When a client connects, it accepts a new socket for that connection.
• A client creates a socket and connects to the server's address and port. The OS picks a temporary local port for it.
• Both sides then send and receive data, and close when done.

A TCP connection is uniquely identified by its two sockets: local IP and port, remote IP and port. A busy web server has one listening socket and thousands of connected sockets, all on port 443, each with a different client address and port.

UDP sockets don't connect; one socket can send to and receive from many addresses. That's why a single UDP socket (like Chrome's QUIC socket) can talk to many servers.

Socket vs port

A port is just a 16-bit number. A socket is the full endpoint inside a program, and its state: listening, established, closing. Many sockets can share one port.

lsof -nP -i lists sockets with their owning processes:

ControlCe 499 jane  10u IPv4 … TCP *:5000 (LISTEN)
Safari   1201 jane  28u IPv4 … TCP 192.168.1.23:60330->17.253.144.10:443 (ESTABLISHED)
mDNSResp  204 _mdns  8u IPv6 … UDP *:5353

ControlCenter has a listening TCP socket on port 5000, Safari a connected socket to Apple's server, and mDNSResponder a UDP socket for Bonjour.

• lsof -nP -i shows sockets per process (add sudo for system processes).
• netstat -an lists all sockets and their states, without process names.
• nettop shows live traffic per socket and process.

Activity Monitor's Network tab counts bytes per process, which is the sum of that process's sockets.

LightAtom is built on socket data: its connections view shows every socket of every process, grouped by app, with bytes per connection, and its Ports view the listening ones.