How does the network port scan work?
GhostPort periodically queries the macOS kernel connection table using standard UNIX system APIs. It detects all local sockets listening for incoming network packets (LISTEN state), for both TCP and UDP.
Support & Assistance
GhostPort
01
Need help with GhostPort?
Welcome to the GhostPort support page. This application enables you to track active listening sockets on your Mac. If you have questions about inspecting port states, system services, or terminating processes (SIGKILL), read our FAQ below.
02
Assistance
Frequently Asked Questions (FAQ)
Why does the app request administrator privileges (password)?
macOS restricts standard users from modifying processes owned by system services or other users. If you choose to terminate a process owned by root (indicated by the red shield icon in the UI), macOS requires admin authentication to authorize the termination.
What does the red (X) button do exactly?
Clicking the red button sends a system SIGKILL signal (equivalent to kill -9 in the command line) to the PID (Process ID) holding the listening socket. This forces the process to stop, immediately releasing the associated network port.
Why are port numbers displayed without spaces?
For technical and standard network conformity, port numbers are displayed raw (e.g., :49173 instead of :49 173), overriding regional number format settings in macOS which can make port searches confusing.
How are application icons resolved?
GhostPort retrieves the file path of the running executable on disk from its PID in the background, then extracts the icon of the parent application bundle to show it in the list.
03
Report an issue or suggest a feature
If the FAQ does not answer your question, please send us an email. Include the following details:
- macOS Versione.g., macOS Sequoia (15.1), macOS Sonoma (14.6)
- Processor Typee.g., Apple M1, Intel Core i7
- Problem Descriptionunclosable processes, missing icons, unexpected behaviors