Are you using sudo
to run lsof
as root? If not, it'll only be able to see files opened by processes you own, and this is probably a system process.
Port 500 is normally used for the isakmp, which is part of the IPSec suite. It'll generally show up on a Mac as a side effect of an IPSec-based VPN service.