Being a Linux user, I am quite accustomed to the netstat flags that I use most often (plant, or sometimes tupac). I recently acquired a MacBook Pro, and found the netstat flags quite different.

clstearns@olly:~$ netstat -ntpl
netstat: l: unknown or uninstrumented protocol
clstearns@olly:~$ netstat -ntl | wc -l
221

clstearns@eli:~$ netstat -ntl | wc -l
6

How annoying it is, having to change one’s habits.

Rather than learning the new flags, I pulled out my trusty lsof:

$ lsof -i tcp:22
COMMAND  PID      USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
ssh     8383 clstearns    3u  IPv4 0x060b0334      0t0  TCP olly.ozymo.com:56829->mail.ozymo.com:ssh (ESTABLISHED)

Using lsof, I can see in the NAME field I can see what kind of connections I have open.

According to the lsof man page, the -i flag takes an option [i] specified as an Internet address. From the man page:

An Internet address is specified in the form (Items in square brackets are optional.):

[46][protocol][@hostname|hostaddr][:service|port]

where:

46 specifies the IP version, IPv4 or IPv6 that applies to the following address. ’6′ may be be specified only if the UNIX dialect supports IPv6.  If neither ’4′ nor ’6′ is specified, the following address applies to all IP versions.

protocol is a protocol name – TCP, UDP

hostname is an Internet host name.  Unless a specific IP version is specified, open
network files associated with host names of all versions will be selected.

hostaddr is a numeric Internet IPv4 address in dot form; or an IPv6 numeric address in
colon form, enclosed in brackets, if the UNIX dialect supports IPv6.  When an IP version is selected, only its numeric addresses may be specified.

service is an /etc/services name – e.g., smtp – or a list of them.

port is a port number, or a list of them.

At  least  one  address  component  -  4, 6, protocol, ,IR hostname , hostaddr, or service – must be supplied. These addresses can get hairy, according to this example, which means TCP, ports 1 through 10, service name smtp, port 99, host name foo:

tcp@foo:1-10,smtp,99

lsof allows me to gain the information I need pertaining to my network connections, and when combined with some of the simpler options for MacOS’s netstat version (Mach-O universal binary with 3 architectures; it’s also the BSD4.2 version, whereas my Ubuntu box reports that the installed netstat command version 1.42 is from the net-tools package) it makes for a very handy tool.

Thanks to Greg and the man for the information on lsof.

/cs