What is `intu-ec-client` listening on TCP port 8021? I'm wondering how I can either kill it or change the port it listens on.
Neither lsof -nP -i4TCP:8021 | grep LISTEN nor netstat -av | grep 8021 or launchctl list | awk 'NR&gt;1 {print $3}' | xargs -I % sh -c 'launchctl list &quot;%&quot;' &gt; launchctl.log give me the process ID so I can kill it or get more info.
So a colleague pointed me to a resource that kind of helps explaining the issue.
https://web.archive.org/web/20201014190758/https://lists.freeswitch.org/pipermail/freeswitch-users/2013-October/100619.html (kudos to @vikasgarg86 for finding  and sending me that link).
Turns out there is this native launchd service com.apple.ftp-proxy.plist living at /System/Library/LaunchDaemons/com.apple.ftp-proxy.plist that fires /usr/libexec/ftp-proxy (https://github.com/drduh/macOS-Security-and-Privacy-Guide/blob/master/launchd/15B42_launchd.csv#L94) which apparently binds to TCP port  8021.
&lt;!DOCTYPE plist PUBLIC &quot;-//Apple//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&gt;
&lt;plist version=&quot;1.0&quot;&gt;
&lt;dict&gt;
        &lt;key&gt;Disabled&lt;/key&gt;
        &lt;true/&gt;
        &lt;key&gt;Label&lt;/key&gt;
        &lt;string&gt;com.apple.ftp-proxy&lt;/string&gt;
        &lt;key&gt;UserName&lt;/key&gt;
        &lt;string&gt;_ftp&lt;/string&gt;
        &lt;key&gt;Program&lt;/key&gt;
        &lt;string&gt;/usr/libexec/ftp-proxy&lt;/string&gt;
        &lt;key&gt;ProgramArguments&lt;/key&gt;
        &lt;array&gt;
                &lt;string&gt;ftp-proxy&lt;/string&gt;
                &lt;string&gt;-p&lt;/string&gt;
                &lt;string&gt;-n&lt;/string&gt;
                &lt;string&gt;-V&lt;/string&gt;
                &lt;string&gt;-D3&lt;/string&gt;
                &lt;string&gt;-t1800&lt;/string&gt;
        &lt;/array&gt;
        &lt;key&gt;inetdCompatibility&lt;/key&gt;
        &lt;dict&gt;
                &lt;key&gt;Wait&lt;/key&gt;
                &lt;false/&gt;
        &lt;/dict&gt;
        &lt;key&gt;Sockets&lt;/key&gt;
        &lt;dict&gt;
                &lt;key&gt;Listeners&lt;/key&gt;
                &lt;dict&gt;
                        &lt;key&gt;SockNodeName&lt;/key&gt;
                        &lt;string&gt;localhost&lt;/string&gt;
                        &lt;key&gt;SockServiceName&lt;/key&gt;
                        &lt;string&gt;8021&lt;/string&gt;
                        &lt;key&gt;SockType&lt;/key&gt;
                        &lt;string&gt;stream&lt;/string&gt;
                &lt;/dict&gt;
        &lt;/dict&gt;
&lt;/dict&gt;
&lt;/plist&gt;

However that's only half the way into actually understanding what is going on. What the original author of the conversation linked here couldn't figure and myself too, is how that service got there in the first place. Why is it even running? and what are the consequences of changing the port from 8021 to something else.
Please comment bellow if you know the answers.
By the way sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ftp-proxy.plist does the job of stopping the service.