1

So I was on my macbook air and I had just installed macOS monterey. I was a bit suspicious of some of the things running on the computer, so I decided to see all of the open ports. I found the command sudo lsof -PiTCP -sTCP:LISTEN to look for the listening ports. However, I got some strange output even though the only application open was the terminal:

launchd TCP localhost:8021 (LISTEN)
rapportd TCP *:49159 (LISTEN)

I did not understand what these two lines were, and why ports 8021 and 49159 were listening despite the firewall being on and strict. Is there a way to block these connections? If anyone could answer this, it would be much appreciated.

TheGeno
  • 33
  • I also blocked all incoming connections on the firewall, yet I still see these ports listening – TheGeno Jan 15 '22 at 22:59
  • For port 8021, is this question related? – gidds Jan 15 '22 at 23:00
  • The only issue is that I never had ftp open on this computer, so I am a bit confused why it's listening on port 8021 (as per the top answer there) if there is no file sharing on (at least I don't believe so) – TheGeno Jan 15 '22 at 23:04
  • rapportd appears to have something to do with handing off phone calls between Apple devices; see "What is rapportd and why does it want incoming network connections?" – Gordon Davisson Jan 15 '22 at 23:44
  • Ah, got you @GordonDavisson, I signed out of iMessage and disabled phone connection and then the port seemed to close so that front seems all good – TheGeno Jan 16 '22 at 00:42
  • Does anyone know though about port 8021, the post @gidds seems to have conflicting answers in the post – TheGeno Jan 16 '22 at 00:42
  • Port 8021 might be the FTP proxy built into macOS (I think it's part of Internet Sharing?). Run sudo launchctl list com.apple.ftp-proxy, and see if it gives you an error ("Could not find service...", in which case it's disabled) or lists its properties (in which case it's enabled). – Gordon Davisson Jan 16 '22 at 01:36
  • @GordonDavisson yeah it listed the properties I believe (had stuff like wait false and the sockets). Is there a way to disable this in the macOS settings? – TheGeno Jan 16 '22 at 01:50
  • I think the FTP proxy gets turned on if you're running Internet Sharing -- are you? If that's why it's on, I'm not sure there's a good way to turn it off. I also don't know of a good reason to turn it off, since I'm pretty sure it's just a proxy -- something to help FTP connections find their way across the shared connection, not something that's actually allowing access to something on your computer. – Gordon Davisson Jan 16 '22 at 02:07
  • Fair enough, thank you so much @GordonDavisson – TheGeno Jan 16 '22 at 02:13

0 Answers0