PortsMonitorDocumentation
PortsMonitor shows the network connections of every process on your Mac. This page covers setup, filtering and the search expression syntax.
Getting started
- Requirements: macOS 10.12 or later.
- Install: download version 1.4.5, unzip it and move PortsMonitor to the Applications folder.
- Trial: the download runs as a free trial for 30 days.
- Buy: a license is $7.99 in the TickPlant store. Five or more licenses get volume pricing.
- Updates: PortsMonitor checks for new versions itself. If an automatic update fails, download the latest version from this site.
PortsMonitor is not on the Mac App Store. Because of the App Store sandbox policy, it has been sold only from this site since version 1.3.5.
Helper tool
To watch all ports opened in the system, PortsMonitor uses a helper tool (added in version 1.4.0). Install it in Preferences › General › Helper Tool.
Main window
Toolbar
| Control | What it does |
|---|---|
| Auto Refresh | How often the list refreshes, for example every 2 seconds. |
| Refresh Now | Refreshes the list immediately. |
| Type | Shows IPv4 or IPv6 connections. |
| Protocol | Shows TCP, UDP or other protocols such as ICMP. |
| Has Remote Address | Hides connections without a remote address, such as listening ports. |
| Filter Profile | Applies a saved search expression. See Search expressions. |
| Filter | Filters by keyword, or by a search expression when Use Search Expression is on. |
Columns
Process ID, Process Name, Type, Protocol, Local Port, Remote Port, Local Address, Remote Address, Remote Hostname, State and Process Path. Choose which ones to show in Preferences › General › Display Columns. Click a column header to sort; ports sort by number.
Row colors
After each refresh, new connections are shown in green, connections whose state changed in yellow, and closed connections in red. Change the colors, the background, the text color and the font size in Preferences › Display.
Search expressions
A search expression filters connections by any field. To use one, click the magnifying glass in the filter field and choose Use Search Expression, then type the expression.
To keep an expression, choose Save Current Search from the same menu. It becomes a filter profile that you can apply from the Filter Profile menu in the toolbar. Manage profiles in Preferences › Filter Profiles.
Syntax
| Operator type | Operators |
|---|---|
| String comparison | =, contains |
| Number comparison | =, <, >, <=, >= |
| Collection | field in {value1, value2} |
| Logic | and, or |
Put string values in single quotes, for example state = 'LISTEN'.
Fields
| Type | Fields |
|---|---|
| String | processName, processId, processPath, protocol, state, localAddress, localPort, localPortName, remoteAddress, remoteHostname, remotePort, remotePortName |
| Number | localPortNumber, remotePortNumber |
localPort and remotePort are strings. To compare ports as numbers, use localPortNumber and remotePortNumber. Port names are service names such as http for port 80.
Examples
Connections to HTTPS servers:
remotePortNumber = 443
Connections to HTTP servers in the CLOSE_WAIT state:
remotePortNumber = 80 and state = 'CLOSE_WAIT'
Connections made by some apps:
processName in {'Safari', 'Mail'}
Connections to the local network:
remoteAddress contains '192.168.1.'
Services listening on low ports:
state = 'LISTEN' and localPortNumber < 1024
Notifications
Set up notifications in Preferences › Notifications:
- Enable notification for new connections
- Enable notification for connections' state change
- Resolve Remote Address in notification shows the hostname instead of the IP address.
Applications in the Exclude Applications list never trigger a notification. Add them with +.
Logs
PortsMonitor can save connection history to CSV files, with every column of each connection. Set this up in Preferences › Log. It can also write to the system console.
Release notes
1.4.5
- Fixed a crash when logging to the system console is turned on.
1.4.4
- Fixed a crash in some situations.
1.4.3
- Fixed showing the geographic location of IP addresses.
- Minor bug fixes.
1.4.1
- Fixed bringing the application to the front.
1.4.0
- Added the helper tool for watching all ports opened in the system.
1.3.5
- Works on OS X 10.9.
- No longer sold on the Mac App Store because of the sandbox policy.
1.3.4
- Fixed a crash on Mac OS X 10.6.8.
1.3.3
- Fixed Has Remote Address not working on some systems.
- Fixed the Growl option for connection state changes.
1.3.1
- Fixed a crash on Mac OS X 10.6.8.
1.3.0
- Added search expressions.
- Added filter profiles: save a search expression and apply it with one click.
- Added sandbox support.
- Local Port and Remote Port now sort by number.
- Fixed auto refresh not starting after launch.
- Fixed the font size after launch.
Support
Questions and bug reports: tickplant.com/contact. License terms: PortsMonitor EULA.