sockets
Shows a snapshot of open sockets.
Synopsis
sockets
Description
The sockets
operator shows a snapshot of all currently open sockets.
Schemas
Tenzir emits socket information with the following schema.
tenzir.socket
Contains detailed information about the socket.
Field | Type | Description |
---|---|---|
pid | uint64 | The process identifier. |
process | string | The name of the process involved. |
protocol | uint64 | The protocol used for the communication. |
local_addr | ip | The local IP address involved in the connection. |
local_port | port | The local port number involved in the connection. |
remote_addr | ip | The remote IP address involved in the connection. |
remote_port | port | The remote port number involved in the connection. |
state | string | The current state of the connection. |
Examples
Show process ID, local, and remote IP address of all sockets:
sockets
| select pid, local_addr, remote_addr