Port 5000 or 7000 in Use on a Mac? It's AirPlay Receiver

ControlCenter is the macOS process behind Control Center and the menu bar items, and it hosts AirPlay Receiver too. It isn't malware. It runs as your user, so lsof shows it without sudo. With AirPlay Receiver on, it holds both ports:

COMMAND   PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
ControlCe 684 alex   15u  IPv4 0x6f0e2a9c4b7d1385      0t0  TCP *:7000 (LISTEN)
ControlCe 684 alex   16u  IPv6 0xd2c95b07e18a4f36      0t0  TCP *:7000 (LISTEN)
ControlCe 684 alex   17u  IPv4 0x1a7f3e5c9b2d6084      0t0  TCP *:5000 (LISTEN)
ControlCe 684 alex   18u  IPv6 0x84c2d6a0f3e95b17      0t0  TCP *:5000 (LISTEN)

lsof cuts the name to nine characters. Add +c 0 to see ControlCenter in full. If the command prints nothing, none of your processes hold those ports.

You can also read the setting itself:

defaults -currentHost read com.apple.controlcenter AirplayReceiverEnabled

1 is on and 0 is off. The key is stored per host, so it needs -currentHost. Many posts copy the misspelling AirplayRecieverEnabled, which isn't the key System Settings writes. If defaults can't find the key, it was never written on this Mac, so go by lsof.

Open System Settings, click General, then AirDrop & Continuity, and turn off AirPlay Receiver. That is the path on macOS 26 and 27 (Apple Support). On macOS 13 to 15 the pane is called AirDrop & Handoff, and on macOS 12 the switch is in System Preferences › Sharing. Typing "AirPlay Receiver" into the System Settings search field gets you there too.

That frees both ports. What you lose is streaming from an iPhone or another Mac to this Mac. AirPlay from this Mac to a TV or speaker still works.

killall ControlCenter doesn't stick. Its launch agent sets KeepAlive, so launchd starts it again and the new process takes the same ports.

While the setting is on, both ports are also open to your network, because *:5000 means every interface, the same as a dev server bound to 0.0.0.0. Apple hasn't said what the default is, but the setting is often on. If you never AirPlay to your Mac, turning it off closes two ports that other devices on your Wi-Fi can reach.

Port 5000 is the default for flask run, which is why Flask users hit this most:

flask run --port 5001

FLASK_RUN_PORT=5001 in the environment does the same, and in code it's app.run(port=5001). In Docker, keep 5000 inside the container and publish a different host port:

docker run -p 127.0.0.1:5001:5000 my-flask-app

Docker Desktop reports the clash as "Ports are not available".

Which one you get depends on the address your server binds. AirPlay holds the wildcard address, so another wildcard bind fails: flask run --host=0.0.0.0, Node's server.listen(5000) or docker run -p 5000:5000. Current Flask names the cause:

Address already in use
Port 5000 is in use by another program. Either identify and stop that program, or start the server with a different port.
On macOS, try searching for and disabling 'AirPlay Receiver' in System Settings.

Node prints Error: listen EADDRINUSE: address already in use :::5000.

Plain flask run binds only 127.0.0.1, and macOS lets a specific address sit next to another process's wildcard. So Flask starts without an error. http://127.0.0.1:5000 reaches Flask, but http://localhost:5000 can resolve to ::1 and land on AirPlay, which answers:

HTTP/1.1 403 Forbidden
Content-Length: 0
Server: AirTunes/595.13.1

That response is quoted from a thread on Apple's Developer Forums. If your app returns an empty 403, check the Server header, then use 127.0.0.1 in the URL or change the port.

Portis lists both ports as ControlCenter rows with an orange dot, which means the network can reach them. Ending ControlCenter from there works no better than killall, so the switch in System Settings is still the fix.