Killing an unknown self restarting server on port

Question

I have a server running on port 80, but I do not know what it is or where it came from. When I run

sudo lsof -i :80 | grep LISTEN

I get

httpd      80    root    5u  IPv6 0x91f5a9de62859cfd      0t0  TCP *:http (LISTEN)
httpd     694    _www    5u  IPv6 0x91f5a9de62859cfd      0t0  TCP *:http (LISTEN)

I have tried to enter get the process name using the PID, but all I ever get in return is "httpd" or "FOREGROUND".

When I kill the PID, the process simply restarts with a new PID. I assume I will have to stop it at launch.

How can I stop this server from running at startup?

If it helps any, I am trying to free up port 80 to use the apache server on MAMP.

Answer 1

This happens to me a lot. As @Gordon Davisson explains it is most likely the launchdeamon process conflicting with the service you have set up. Definitely stop the apachetl server.

sudo apachetl -k stop

Try to find all the httpd process, they should be the last ones

sudo lsof -i :80 // without grep

Then get the first process (most likely in the 1000s) should also be the lowest one.

sudo kill <firstHttpdPID>

This should kill ALL the processes running that httpd instance and then you get simply start back up your server. Must stop it first though or it will continue running again.

Answer 2

This is just a guess, but it might be the built-in version of apache, being launched (& restarted) by launchd (OS X's daemon manager). It's disabled by default, but might've gotten enabled somehow. You can try disabling it with:

sudo launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist

If that doesn't do it (it'll say something like "Could not find specified service"), you can check to see if it's some other launch daemon item by looking for the PID of the master process (the one running as root, not _www):

sudo launchctl list | grep <masterPID>

That won't necessarily tell you exactly what's going on, but might point you in the right direction.

Answer 3

Like Gordon suggested, that's the built-in version of the Apache web server.

You can stop it with

sudo apachectl stop

btw, the configuration for this webserver can be found in the /etc/apache2/httpd.conf directory.