Search code examples
macosudpnetstat

Unclear connection information in Mac OS X

On Mac OS X (10.9) the netstat command in the terminal prints the following. What means *.* in this context? Is this a client or a server socket? How can I find out which process opens this connection(s), and for what reason?

$ netstat -an
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Adress          Foreign Address        (state)
[...]
udp4       0      0  *.*                   *.*
udp46      0      0  *.*                   *.*
[...]
Solution

  • A *.* in the Local Adress column for UDP means that the socket hasn't been bound to a specific port.

    AFAIK such a socket can't really be used for anything. If you try to use it for receiving, it won't listen to anything. If you try to use it for sending, it will automatically be bound to a port.

    So my only conclusion is that they're sockets kept for sending data, but no data has been sent on them yet (since it's the first call to sendto that binds the port).

    You can find the process who owns a socket by using lsof. It has a lot of filtering options but I usually find it easier to just just grep, like so:

    sudo lsof -n | grep -F "UDP *:*"

    The -n turns off dns resolution which otherwise might take quite some time.

    Edit: It might also be to call ioctl(..., SIOCGIFMEDIA) or similar to get network interface information.