Understanding what lsof socket/port aliases refer to
Earlier in the week we wanted to check which ports were being listened on and by what processes which we can do with the following command on Mac OS X:
$ lsof -ni | grep LISTEN idea 2398 markhneedham 58u IPv6 0xac8f13f77b903331 0t0 TCP *:49410 (LISTEN) idea 2398 markhneedham 65u IPv6 0xac8f13f7799a4af1 0t0 TCP *:58741 (LISTEN) idea 2398 markhneedham 122u IPv6 0xac8f13f7799a4711 0t0 TCP 127.0.0.1:6942 (LISTEN) idea 2398 markhneedham 249u IPv6 0xac8f13f777586711 0t0 TCP *:63342 (LISTEN) idea 2398 markhneedham 253u IPv6 0xac8f13f777586331 0t0 TCP 127.0.0.1:63342 (LISTEN) java 16973 markhneedham 152u IPv6 0xac8f13f777586af1 0t0 TCP *:56471 (LISTEN) java 16973 markhneedham 154u IPv6 0xac8f13f779e6b711 0t0 TCP *:menandmice-dns (LISTEN) java 16973 markhneedham 168u IPv6 0xac8f13f77b902f51 0t0 TCP 127.0.0.1:7474 (LISTEN) java 16973 markhneedham 171u IPv6 0xac8f13f77b013711 0t0 TCP 127.0.0.1:7473 (LISTEN)
One of the interesting things about this output is that for the most part it shows the port number and which IPs it will accept a connection from but sometimes it uses a socket/port alias.
In this case we can see that the 3rd last line refers to 'menandmice-dns' but others could be 'http-alt' or 'mysql'.
We can find out what port those names refer to by looking in /etc/services:
$ cat /etc/services | grep menandmice-dns menandmice-dns 1337/udp # menandmice DNS menandmice-dns 1337/tcp # menandmice DNS
$ cat /etc/services | grep http-alt http-alt 591/udp # FileMaker, Inc. - HTTP Alternate (see Port 80) http-alt 591/tcp # FileMaker, Inc. - HTTP Alternate (see Port 80) http-alt 8008/udp # HTTP Alternate http-alt 8008/tcp # HTTP Alternate http-alt 8080/udp # HTTP Alternate (see port 80) http-alt 8080/tcp # HTTP Alternate (see port 80)
There's a massive XML document on the IANA website with a full list of the port assignments which is presumably where /etc/services is derived from.