3 ms·
I don't know about production, but I use it on my MacOS laptop to list all listening sockets with the associated command line. Should I be concerned that this s
by Myrmornis 3y ago
I don't know about production, but I use it on my MacOS laptop to list all listening sockets with the associated command line. Should I be concerned that this sort of thing has correctness bugs? (Can anyone give a competing non-osquery implementation on MacOS?)
sockets() {
(osqueryi --list --separator ',' | column -t -s ',') <<EOF
SELECT s.local_port, p.cmdline
FROM process_open_sockets AS s
INNER JOIN processes AS p
ON s.pid = p.pid
WHERE s.state = 'LISTEN'
ORDER BY p.cmdline;
EOF
}
- woodruffw 3y agoThere's at least one open data quality issue for `process_open_sockets` on macOS[1]. It's a few years old however and, if you aren't seeing that casting error, you probably aren't hitting it. But that's a good example of the kind of debt that's been built up over time. (In terms of general purpose/flexible tooling, I'm not aware of a close replacement for osquery.) [1]: https://github.com/osquery/osquery/issues/6319 https://github.com/osquery/osquery/issues/6319
- Myrmornis 3y agoThanks! I'll watch out for that one.
- mikermcneil 3y agoWas about to say "will fix ASAP", but double-plus since it's @nyanshak!
- deleted 3y ago[deleted]
- noahtaleran 3y agoYo! We're working on the fix. You can track progress here: https://github.com/fleetdm/fleet/issues/17165 https://github.com/fleetdm/fleet/issues/17165
- signa11 3y ago> Can anyone give a competing non-osquery implementation on MacOS? shouldn't lsof with some awk munging get you there ? edit-01: for example lsof -iTCP -sTCP:LISTEN -n -P | awk '{print $1, substr($0, index($0,$9))}' might be useful enough ? fwiw, it does give me something useful on my machine
- MrBuddyCasino 3y agoThanks, added. alias ports="lsof -iTCP -sTCP:LISTEN -n -P | awk '{print \$1, substr(\$0, index(\$0,\$9))}'"