Ports 137, 161, and 7000 are scanned by macOS for network discovery and management services. Port 137 is used by NetBIOS for local network name resolution, port 161 serves SNMP for device monitoring, and port 7000 often hosts application servers or development tools. These activities are normal background behaviors that help your Mac communicate with other devices on the same local area network.
Understanding the Purpose of These Ports
When you observe network activity involving ports 137, 161, and 7000, it is important to understand what each service does before assuming a security threat. macOS includes built-in utilities to facilitate communication with printers, file shares, and other networked hardware. Disabling these services entirely can break functionality like AirPrint, Time Machine backups over the network, or access to shared drives. Port 137 is part of the NetBIOS suite. It allows your Mac to discover and connect to Windows-based computers and network-attached storage (NAS) devices within the same subnet. If you have a home network with mixed operating systems, this port is essential for browsing network neighborhoods and mapping drives. Port 161 is associated with Simple Network Management Protocol (SNMP). While less common in home environments, it is used by routers, switches, and enterprise-grade hardware to report status information. Your Mac might query these devices to check connectivity or manage network settings through system preferences. Port 7000 is not assigned to a specific universal standard but is frequently used by local development servers, database tools, or specialized applications like Adobe Creative Cloud services or Docker containers. If you are a developer or use creative software, this port likely belongs to an active process on your machine rather than an external scanner.Determining if the Activity is Legitimate
Before taking action, verify whether the scanning originates from your Mac or is directed at it. You can check this by opening the Activity Monitor application, located in the Utilities folder within Applications. Look for processes namedmDNSResponder, snmpd, or any custom application you recently installed. If the CPU usage is low and the process is known, the activity is likely benign.
Another method is to review the system logs. Open the Console app and filter by network or the specific process name. This will show you exactly which application is initiating the connection. If you see entries related to com.apple.mDNSResponder, it confirms that the traffic is part of standard Apple Bonjour service operations.
If you suspect an unknown application is causing the traffic, identify the process ID (PID) using the Terminal command lsof -i :137. Replace 137 with 161 or 7000 as needed. The output will list the executable path, allowing you to determine if it is a system component or third-party software.
Managing Network Discovery Services
If you wish to reduce network noise or enhance privacy, you can adjust how your Mac advertises itself and scans for others. For NetBIOS and mDNS, go to System Settings, then Network. Select your active interface, such as Wi-Fi or Ethernet, and click Details. Look for options related to "Bonjour" or "Local Network" permissions. You can restrict which apps are allowed to use local networks. In System Settings, navigate to Privacy & Security, then Local Network. Here, you can toggle off access for specific applications that do not require network discovery features. This prevents unnecessary scanning by non-essential software while keeping core services functional. For SNMP, ensure that no remote management profiles are active unless required for enterprise IT management. Check Configuration Profiles in System Settings to see if any organization-enforced policies are enabling SNMP agents. Removing unnecessary profiles can stop unwanted background queries. Regarding port 7000, close any open development servers or local web hosts when not in use. If you are running a local server for testing, configure it to bind only to localhost (127.0.0.1) instead of all interfaces (0.0.0.0). This ensures that the port is not visible to other devices on the network, eliminating external scanning visibility.Advanced Diagnostics with Terminal
For more detailed analysis, use the Terminal to inspect active connections. The commandnetstat -an | grep 137 displays all connections on port 137. Look for states like LISTEN or ESTABLISHED. A high number of connections might indicate a misconfigured router or a network loop.
Similarly, check port 161 with netstat -an | grep 161. If you see incoming connections from unexpected IP addresses, investigate those sources. Use whois on the IP address to determine its origin, though local IPs (starting with 192.168.x.x or 10.x.x.x) are generally safe.
For port 7000, use sudo lsof -i :7000. The sudo prefix may be necessary to view all details. Identify the parent process tree to understand why the port is open. If it is a stray process, you can terminate it using the kill command followed by the PID.