mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-06 09:35:20 +00:00
19 lines
879 B
Plaintext
19 lines
879 B
Plaintext
table_name("process_open_sockets")
|
|
description("Processes which have open network sockets on the system.")
|
|
schema([
|
|
Column("pid", INTEGER, "Process (or thread) ID", index=True),
|
|
Column("fd", BIGINT, "Socket file descriptor number"),
|
|
Column("socket", BIGINT, "Socket handle or inode number"),
|
|
Column("family", INTEGER, "Network protocol (IPv4, IPv6)"),
|
|
Column("protocol", INTEGER, "Transport protocol (TCP/UDP)"),
|
|
Column("local_address", TEXT, "Socket local address"),
|
|
Column("remote_address", TEXT, "Socket remote address"),
|
|
Column("local_port", INTEGER, "Socket local port"),
|
|
Column("remote_port", INTEGER, "Socket remote port"),
|
|
Column("path", TEXT, "For UNIX sockets (family=AF_UNIX), the domain path"),
|
|
])
|
|
implementation("system/process_open_sockets@genOpenSockets")
|
|
examples([
|
|
"select * from process_open_sockets where pid = 1",
|
|
])
|