LightAtom

netstat on Mac: Connections, Ports and Routes

netstat shows sockets, routes and interface counters. On macOS it doesn't show which process owns a socket; pair it with lsof for that.

netstat -an -p tcp

All TCP sockets with numeric addresses, including listening ones.

intermediate10 minNeeds: Terminal

When to use it

Use netstat to see the routing table (which gateway and interface traffic uses), count connections by state, or check interface error counters. To find which app owns a socket, use lsof.

Steps

  1. List connections

    -a includes listening sockets, -n keeps addresses numeric, -p limits the protocol.
    netstat -an -p tcp

  2. Only listening ports

    Filter with grep.
    netstat -an -p tcp | grep LISTEN

  3. Routing table

    -r shows routes; -f inet or inet6 picks the family.
    netstat -rn -f inet

  4. Interface statistics

    -i shows packets and errors per interface; -b adds bytes.
    netstat -ib

  5. Look up one route

    route get shows which gateway and interface a destination uses.
    route -n get 1.1.1.1

Output explained

The routing table on a Mac on Wi-Fi:

Destination        Gateway            Flags               Netif Expire
default            192.168.1.1        UGScg                 en0
192.168.1/24       link#14            UCS                   en0      !
192.168.1.1        72:1d:18:77:9c:11  UHLWI                 en0    717
  • default is the route for everything not listed: via the router on en0.
  • 192.168.1/24 link#14 means the local subnet is reached directly on that interface.
  • Flags: U up, G gateway, S static, H host route, L link-layer address, W cloned, I interface-scoped.

Connections from netstat -an look like tcp4 0 0 192.168.1.23.60330 17.253.144.10.443 ESTABLISHED: macOS separates the port with a dot.

Options and variations

FlagMeaningExample
-aInclude listening socketsnetstat -a
-nNumeric addresses and portsnetstat -an
-p PROTOOnly tcp, udp, icmp…netstat -an -p udp
-rRouting tablenetstat -rn
-f inet|inet6Address familynetstat -rn -f inet6
-i / -ibInterface packet / byte countersnetstat -ib

Common errors

ErrorCauseFix
No process namesmacOS netstat can't show the owning processUse lsof -nP -i instead.
Two default routesSeveral interfaces (Wi-Fi, Ethernet, VPN) are upThe first one in service order wins; check with route -n get default.

Do it in the app

LightAtom's connections view shows netstat's connection list with the process, domain and bytes for each, and its Ports view the listening sockets with their owners.

Frequently asked questions

How do I see open ports with netstat on a Mac?

Run netstat -an -p tcp | grep LISTEN. It shows listening addresses and ports, but not the process; use lsof -nP -iTCP -sTCP:LISTEN for that.

What does netstat -rn show?

The routing table with numeric addresses: the default gateway, local subnets and host routes, and the interface each uses.

Why doesn't netstat -b work like on Windows?

On Windows -b shows process names. On macOS -b shows byte counts with -i. Process information comes from lsof on a Mac.

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.