What’s running on port 5000 on my Mac?

Confirm it’s AirPlay

lsof -nP -iTCP:5000 -sTCP:LISTEN

COMMAND     PID  USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
ControlCe   612   you    9u  IPv4  0x...       0t0  TCP *:5000 (LISTEN)
ControlCe   612   you   10u  IPv6  0x...       0t0  TCP *:5000 (LISTEN)

ControlCe is ControlCenter cut short by lsof. It also holds port 7000. Don’t kill it: it’s the process behind the menu bar’s Control Center, and macOS restarts it right away anyway. More on it in what is ControlCenter.

With Stat Space: statspace port 5000.

Option 1: turn off AirPlay Receiver

System Settings › General › AirDrop & Handoff › AirPlay Receiver: off. Port 5000 and 7000 free up immediately, no restart. Changing “Allow AirPlay for” to Current User doesn’t help; the listener stays.

Option 2: move your app

Tool	Use another port
Flask	flask run --port 5001 or FLASK_RUN_PORT=5001
Flask (in code)	app.run(port=5001)
ASP.NET Core	dotnet run --urls http://localhost:5050, or applicationUrl in launchSettings.json
Docker Registry	docker run -p 127.0.0.1:5050:5000 registry:2

Note that 5001 is also .NET’s old HTTPS default, so pick 5050 or 5100 if you use both.

If it isn’t ControlCenter

Then it’s really one of your servers. A Python process is Flask or another Python app; dotnet is Kestrel. Check its folder with lsof -a -p <PID> -d cwd -Fn | tail -1 and stop it with kill <PID>.

Flask’s development server binds to 127.0.0.1 unless you pass --host 0.0.0.0. With debug=True on all interfaces, the Werkzeug debugger lets anyone who can reach it run Python on your Mac, so never combine the two on a shared network.

Seeing it live

Stat Space lists every listening port with its full process name, project folder and launcher, so ControlCenter on 5000 and your own Flask or .NET server elsewhere are easy to tell apart. statspace port 5000 answers the same from Terminal.