Your Mac may look calm on the outside, but underneath that polished aluminum shell, dozens of network conversations can be happening at once. A browser may be talking to a web server, iCloud may be synchronizing files, a development server may be listening on port 3000, and a VPN may be quietly rewriting your routing table.

The netstat command helps you see this hidden activity. Its name is short for “network statistics,” although it can reveal much more than statistics. On macOS, you can use it to inspect active connections, listening ports, network interfaces, routing tables, protocol counters, and connection states.

This guide explains how to use the Netstat command on Mac with practical examples, macOS-specific options, troubleshooting recipes, and alternatives for tasks that Netstat does not handle particularly well.

What Does Netstat Do on a Mac?

Netstat reads networking information maintained by the macOS networking stack and displays it in Terminal. Depending on the options you provide, it can show active sockets, interface activity, protocol statistics, multicast memberships, routing information, listen queues, and other diagnostic data.

Common reasons to use Netstat include:

• Checking whether a local service is listening on a port
• Viewing established TCP connections
• Finding your Mac’s default network route
• Monitoring packets moving through Wi-Fi or Ethernet
• Investigating dropped packets or protocol errors
• Confirming whether a VPN changed the routing table
• Comparing IPv4 and IPv6 network activity

Netstat is primarily a reporting tool. It shows what the networking stack knows, but it does not normally create connections, close ports, block traffic, or change network settings.

How to Open Netstat in macOS Terminal

Netstat is included with macOS, so you do not need Homebrew, MacPorts, or a mysterious installer downloaded from a website last updated when flip phones were fashionable.

1. Press Command + Space to open Spotlight.
2. Type Terminal.
3. Press Return.
4. Enter a Netstat command and press Return again.

Start with the basic command:

This displays active network sockets. The output may be long because modern Macs maintain many local and remote connections.

To view the manual installed on your Mac, run:

Press Q to leave the manual. Checking the local manual is a good habit because available options can vary between macOS releases.

How to Read Netstat Output

A typical TCP entry contains columns similar to these:

Proto

The protocol column may display values such as tcp4, tcp6, udp4, or udp6. The number indicates whether the socket uses IPv4 or IPv6.

Recv-Q and Send-Q

Recv-Q represents data waiting to be read by the local application. Send-Q represents data waiting to be transmitted or acknowledged. An occasional nonzero value is not automatically a problem. A queue that remains large may indicate a stalled application, an overloaded service, or an unreliable connection.

Local Address

The local address identifies your Mac’s IP address and port. Mac Netstat commonly separates the port with a period rather than a colon. For example, 127.0.0.1.3000 means local port 3000 on the loopback address.

Foreign Address

The foreign address identifies the remote host and remote port. An asterisk usually means that no specific remote endpoint is associated with the socket.

State

TCP states describe the current phase of a connection. Netstat’s macOS manual documents states including LISTEN, SYN_SENT, ESTABLISHED, CLOSE_WAIT, FIN_WAIT_1, and TIME_WAIT. These states reflect TCP’s connection-oriented state machine.

• LISTEN: A service is waiting for incoming TCP connections.
• ESTABLISHED: The local and remote endpoints have an active connection.
• SYN_SENT: Your Mac has started opening a connection and is waiting for a response.
• CLOSE_WAIT: The remote side closed its half, but the local application has not finished closing.
• TIME_WAIT: The connection has closed, but macOS is temporarily retaining its state to handle delayed packets safely.

A few TIME_WAIT entries are normal. Even a large number may simply reflect a busy browser or web server. Networking output loves drama, but not every dramatic-looking line is an emergency.

Essential Netstat Commands for macOS

1. Display All Sockets with Numeric Addresses

The -a option includes all sockets, including server sockets. The -n option prevents hostname and service-name resolution, so addresses and ports remain numeric. Numeric output is usually faster and easier to search.

2. Find Listening TCP Ports

This filters the results to TCP sockets waiting for incoming connections. UDP does not establish TCP-style connections, so UDP sockets do not normally display a LISTEN state.

For a case-insensitive search, use:

3. Search for a Specific Port

To see whether port 8080 appears in the socket list, run:

The escaped period helps match the port separator used in macOS output. A broader search also works, although it may catch unrelated numbers:

4. Display Only IPv4 Sockets

The -f inet option limits the report to the IPv4 address family.

5. Display Only IPv6 Sockets

This is useful when a service appears unavailable over IPv4 but is listening on an IPv6 address such as ::1 or ::.

6. Show the Routing Table

The -r option displays routes, while -n keeps gateways and destinations numeric. Each entry describes a destination, the gateway or interface used to reach it, route flags, and the associated network interface.

To focus on the default route, use:

The default route is the path macOS uses when no more specific route matches a destination. After connecting to a VPN, you may see new default or scoped routes.

7. View Network Interfaces

This displays interfaces and cumulative packet counts. Interface names may include:

• lo0 for the loopback interface
• en0 or en1 for Wi-Fi or Ethernet
• utun0, utun1, and similar names for tunnel or VPN interfaces
• awdl0 for Apple Wireless Direct Link

8. Include Byte Counters

The -b option adds incoming and outgoing byte counts to the interface display. These values are cumulative, so they usually continue increasing until the system or interface is reset.

9. Monitor an Interface Continuously

This prints updated statistics for en0 every second. Replace en0 with the correct interface name for your Mac. Use Control + C to stop the report.

The -I option selects an interface, while -w sets the update interval in seconds.

10. Display Protocol Statistics

This command displays cumulative statistics for network protocols, potentially including TCP, UDP, IP, ICMP, and IPv6-related counters.

To hide counters whose value is zero, repeat the option:

To concentrate on TCP statistics, use:

Some TCP counters may require elevated privileges. When permission restrictions apply, run the command with sudo:

11. Inspect Listen Queue Sizes

The -L option displays listen queue information. Queue statistics can help diagnose a server that accepts connections too slowly or receives more connection attempts than its backlog can handle.

12. Prevent Address Truncation

The -W option avoids shortening addresses in supported displays. The result may look less tidy, but complete addresses are more useful than beautiful ellipses during troubleshooting.

How to Find Which Process Is Using a Port

This is where many Linux tutorials send Mac users into a small command-line swamp. On some Linux systems, netstat -p displays process information. On macOS, -p refers to a protocol, not a process ID.

Use Netstat to confirm that a port exists, and then use lsof to identify its owner.

For example, check port 8080 with:

Then identify the listening process:

In this command:

• -n disables hostname resolution.
• -P keeps port numbers numeric.
• -iTCP:8080 selects TCP port 8080.
• -sTCP:LISTEN limits results to listening TCP sockets.

The macOS lsof documentation supports filtering network files by protocol, port, IP version, and TCP state, making it more suitable than Netstat for connecting sockets to process names and PIDs.

Practical Netstat Troubleshooting Examples

A Development Server Says Its Port Is Already in Use

Suppose Node.js, Python, Docker, or another tool reports that port 3000 is occupied.

If a listening socket appears, identify the process:

Do not immediately terminate the process merely because its name looks unfamiliar. Confirm that it belongs to your abandoned development server rather than a system component or another project.

A Website or Remote Service Will Not Connect

Check whether your Mac is repeatedly attempting to establish a TCP session:

Many persistent SYN_SENT entries can suggest that outgoing requests are not receiving replies. Possible causes include a remote server outage, firewall filtering, incorrect routing, VPN trouble, or an unreachable destination.

Next, inspect the routes:

Netstat cannot prove where every packet disappeared, but it can help determine whether your Mac has a plausible route before you reach for tools such as ping, traceroute, dig, or nc.

A VPN Changed Your Network Behavior

Capture the routing table before connecting:

Connect the VPN and capture it again:

Compare the files:

Look for new tunnel interfaces, default routes, gateway changes, or more-specific network routes. This is often faster than staring at two walls of output and hoping your eyes develop built-in version control.

You Suspect an Application Has an Unexpected Connection

Start by listing established sockets numerically:

Then use lsof or nettop to associate those connections with processes. The interactive nettop utility can monitor TCP and UDP sockets, filter by process, and refresh its display periodically.

Press Q to quit.

Netstat on Mac Versus Netstat on Linux

Although the command has the same name, its options are not identical across operating systems. Commands copied from an Ubuntu or CentOS tutorial may fail on macOS.

A commonly copied Linux command is:

That combination is not a portable Mac command. On macOS:

• -p selects a protocol rather than displaying a PID.
• TCP and UDP are not selected with the same Linux-style flags.
• Listening ports are commonly found with netstat -an | grep LISTEN.
• Process ownership is better inspected with lsof or nettop.

Platform-specific differences explain errors such as “unknown or uninstrumented protocol” when Linux option bundles are entered on a Mac.

Common Problems and Simple Fixes

Netstat Appears to Pause

It may be trying to translate numeric addresses and ports into hostnames and service names. Add -n:

A Port Is Shown as a Name Instead of a Number

Netstat can display registered service names for known ports. Port and service-name assignments are maintained in registries such as the IANA Service Name and Transport Protocol Port Number Registry.

Use -n to keep the port numeric.

The Command Is Not Found

Try the full system path:

If that works, your shell’s PATH configuration may not include /usr/sbin.

Protocol Statistics Show Zeros

Some TCP statistics are restricted for security reasons. Try:

Netstat Does Not Show the Application Name

That is expected. Use:

For a live, process-oriented view, use:

Useful Companion Commands

Netstat is valuable, but it is only one member of the Mac networking toolbox.

• lsof -nP -i lists processes with open network sockets.
• nettop provides a live, process-oriented network display.
• ifconfig displays interface addresses and configuration.
• route examines or changes individual routes.
• ping tests basic reachability and round-trip response.
• traceroute displays the path toward a destination.
• dig investigates DNS queries and responses.
• nc tests TCP or UDP ports and creates simple connections.
• networkQuality measures capacity and responsiveness rather than listing sockets.

Conclusion

Learning how to use the Netstat command on Mac gives you a direct view into sockets, listening ports, TCP states, interface traffic, protocol counters, and routing decisions. For everyday work, the most useful commands are netstat -an, netstat -an | grep LISTEN, netstat -rn, netstat -i, and netstat -s.

The most important limitation to remember is that macOS Netstat is not the same as Linux Netstat. When you need a process name or PID, pair it with lsof or switch to nettop. Used together, these utilities can turn “something weird is happening with the network” into a much more useful diagnosis.

Practical Experience: Lessons From Troubleshooting Networks on a Mac

The most effective way to use Netstat is not to memorize every flag. It is to begin with a clear question. Running netstat -an without knowing what you are looking for can produce enough output to wallpaper a small office. Asking “Is port 8080 listening?” or “Did my VPN replace the default route?” immediately narrows the investigation.

A reliable workflow starts with numeric output. Hostname resolution can make reports slower and can disguise the port numbers you actually need. For that reason, -n belongs in nearly every troubleshooting command. It also makes before-and-after comparisons cleaner because DNS results cannot change the displayed names between captures.

Another useful lesson is to separate socket discovery from process discovery. Netstat is excellent at showing that a connection or listener exists. It is less helpful when the real question is, “Which application created it?” The quickest approach is often a two-step sequence: locate the port with Netstat, then hand the investigation to lsof. Trying to force one tool to do everything usually creates a longer command and a shorter temper.

Timing also matters. Network connections can appear and disappear in milliseconds. If an application fails only occasionally, a single Netstat snapshot may miss the event completely. Repeating a command with tools such as watch is common on Linux, but macOS does not include the same workflow by default. Netstat’s own -w interval is useful for interface and protocol statistics, while nettop is generally more convenient for live per-process activity.

Routing investigations become much easier when you collect evidence before changing anything. Before enabling a VPN, switching Wi-Fi networks, or connecting a USB Ethernet adapter, save the routing table to a file. Capture it again after the change and compare the two versions. This turns a vague suspicion into specific differences involving gateways, tunnel interfaces, or scoped routes.

TCP states also need context. A long list of TIME_WAIT sockets does not necessarily mean the Mac is infected, broken, or emotionally unavailable. Busy web browsers, development servers, synchronization clients, and command-line package managers can create many short-lived connections. More concerning patterns include large queues that remain stuck, repeated SYN_SENT attempts to the same destination, or a growing collection of CLOSE_WAIT sockets associated with one application.

Port numbers should be treated as clues, not final identifications. Port 443 commonly carries HTTPS, but seeing a connection to port 443 does not tell you whether it belongs to Safari, a software updater, cloud synchronization, or another encrypted service. Likewise, a process can use a nonstandard port for an otherwise familiar protocol. IANA registrations and the local /etc/services file provide useful names, but the owning process and application context matter more.

Finally, avoid treating every unfamiliar connection as malicious. macOS runs background services for notifications, synchronization, device discovery, software updates, and continuity features. Investigate unusual entries methodically: record the address, identify the process, check whether the connection returns after closing the application, and compare behavior with and without a VPN or browser extension. Calm evidence beats enthusiastic guessing every time.

Note: Command output and available flags can vary across macOS versions. Confirm behavior on the target Mac with man netstat. This guide was synthesized from macOS and BSD manual pages, Apple networking materials, IETF TCP specifications, the IANA port registry, established Unix documentation, and practical Mac troubleshooting references.