diff --git a/tornado/test/netutil_test.py b/tornado/test/netutil_test.py
index 9f707a8d..89d782e6 100644
--- a/tornado/test/netutil_test.py
+++ b/tornado/test/netutil_test.py
@@ -1,5 +1,6 @@
 from __future__ import absolute_import, division, print_function, with_statement
 
+import platform
 import signal
 import socket
 from subprocess import Popen
@@ -146,6 +147,13 @@ class IsValidIPTest(unittest.TestCase):
         self.assertTrue(not is_valid_ip('\x00'))
 
 
+# The mac firewall prompts when listening on "localhost" instead of
+# "127.0.0.1" like the other tests use (maybe due to the ipv6
+# link-local address fe80::1%lo0?), and it doesn't remember whether
+# you've previously allowed or denied access.  It's better to skip this
+# test on the mac than to have the prompts come up for every configuration
+# in tox.ini.
+@unittest.skipIf(platform.system() == 'Darwin', 'avoid firewall prompts on Mac')
 class TestPortAllocation(unittest.TestCase):
     def test_same_port_allocation(self):
         sockets = bind_sockets(None, 'localhost')