Find process associated with launchd

TCP port 5901 is open on my machine and is causing some mischief, and I want to know which process is opening it. When I run lsof -i -P I see that launchd is the process that opened the port.

Is there a quick way I can determine which launchd plist file is being used to open that port? I'd rather not have to go through each plist mentioned by launchctl list.

Solution 1:

First, is this being opened by the system launchd (process ID 1, running as root), or a user launchd (running as a user)? If it's the system launchd, you're looking for a LaunchDaemon; if it's a user launchd, you're looking for a LaunchAgent.

Assuming it's the system launchd, you can look for the relevant LaunchDaemon like this:

grep 5901 {,/System}/Library/LaunchDaemons/*

(note: if port 5901 were listed in /etc/services, you'd also have to look for it by name as well as number. But it isn't, so you don't have to worry about that.)

It's also possible that it's a LaunchDaemon that was loaded from some other place; tracking that down would be messy, so start with the easy check first.

Solution 2:

Port 5901 is used for VNC (Remote Desktop screen sharing on OS X) and by design launchd actually reads all of the configuration files that are loaded on your Mac and then listens on ports rather than starting the program that eventually will receive communications on that port.

In this case, since you only see launchd and not a screensharingd or ScreensharingAgent process you might just be able to conclude that launchd is listening as a proxy for another process that isn't running at present (or perhaps yet to run).

You can test this by disabling the screen sharing settings in System Preferences or uninstalling any other remote VNC server software you have and then re-examining lsof.