After learning about and trying sudo lsof -i
and sudo lsof -iTCP
, and reading "Do web browsers use different outgoing ports for different tabs?", I think I'm just reading the output from lsof
incorrectly.
Here's an example:
$ sudo lsof -iTCP:80 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ... firefox xxxx user xxxxxx IPv4 xxxxxxxxx xxxxxx TCP 192.168.0.100:12345->stackoverflow.com:http (ESTABLISHED)
Looking at this example and other output from sudo lsof -i
I think it's pretty clear that this line from Firefox appears in the output because Firefox is connecting to port 80 on a remote server, from the local port 12345. Firefox is not connecting to a remote server from the local port 80.
I don't know if it is possible for a client like Firefox to connect from port 80 while a local server is listening on port 80, but what is happening here at least doesn't seem to challenge that idea, because that is not what Firefox is doing.
sudo lsof -i:80 -s TCP:^LISTEN
shows the connections to port 80 on remote computers, unless a local client uses local port 80 to connect to something. It's strange there doesn't seem to be an option to just list which local ports are in use.