sockstat
List open Internet or UNIX domain sockets. tldr-pages
On Linux, FreeBSD, NetBSD 1 Sigma rule name it
Linux
Show information for IPv4 and IPv6 sockets for both listening and connected sockets
sockstatIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Show information for IPv4/IPv6 sockets listening on specific ports using a specific pRotocol
sockstat -4 -l -R tcp -p port1,port2...IdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Also show connected sockets and unix sockets
sockstat -cuIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Only show sockets of the specified process_id or process
sockstat -P process_idIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Only show sockets of the specified user_id or user
sockstat -U user_idIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Only show sockets of the specified group_id or group
sockstat -G group_idIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
FreeBSD
View which users/processes are listening on which ports
sockstat -lIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Show information for IPv4/IPv6 sockets listening on specific ports using a specific Protocol
sockstat -4 -l -P tcp -p port1,port2...IdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Also show connected sockets, not resolving numeric UIDs to user names and using a wider field size
sockstat -cnwIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Only show sockets that belong to a specific jail ID or name in verbose mode
sockstat -jvIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Display the protocol state and the remote UDP encapsulation port number, if applicable (these are currently only implemented for SCTP and TCP)
sockstat -sUIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Display the Congestion control module and the protocol Stack, if applicable (these are currently only implemented for TCP)
sockstat -CSIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Only show Internet sockets if the local and foreign addresses are not in the loopback network prefix 127.0.0.0/8, or do not contain the IPv6 loopback address ::1
sockstat -LIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Do not show the header (quiet mode), showing unix sockets and displaying the inp_gencnt
sockstat -quiIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
NetBSD
List open Internet or UNIX domain sockets. Note: This program is a rewrite for NetBSD 3.0 from FreeBSD's sockstat.
Show information for IPv4, IPv6, and Unix sockets for both listening and connected sockets
sockstatIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Show information for IPv4/IPv6 sockets listening on specific ports using a specific Protocol
sockstat -4 -l -P tcp -p port1,port2...IdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Also show connected sockets, showing unix sockets
sockstat -cuIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Only show numeric output, without resolving symbolic names for addresses and ports
sockstat -nIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Only list sockets of the specified address family
sockstat -f inetIdentifyTrips 1 Sigma rule: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community