15 Useful ‘Sockstat Command Examples’ to Find Open Ports in FreeBSD

[‘

n

Sockstat is a versatile command line utility used for displaying network and system opened sockets in FreeBSD. Mainly, sockstat command is installed by default in FreeBSD and it’s commonly used for displaying the name of the processes who opened a certain network port on a FreeBSD system.

n

However, sockstat can also list open sockets based on protocol version (both IP versions), on the state of the connection and on what ports a daemon or a program binds and listens on.

n

Read Also: 20 Useful ‘netstat’ Command Examples to Check Network Connections

n

It can also display inter-process communication sockets, typically known as Unix domain sockets or IPC. Sockstat command combined with grep filter or piped through awk utility proves to be a powerful tool for the local networking stack.

n

It can shrink the results for an opened connection based on the user who owns the socket, the file descriptor of a network socket or the PID of the process who opened the socket.

n

In this guide we’ll list some common utilization examples, but also very powerful, of sockstat command line networking utility in FreeBSD.

n

Requirements

n

    n

  1. FreeBSD 11.1 Installation Guide
  2. n

n

1. List All Opened Ports in FreeBSD

n

Simply executed without any options or switches, sockstat command will display all opened sockets in a FreeBSD system, as illustrated in the below screenshot.

n

# sockstatrn

n

Display Network Ports in FreeBSD
Display Network Ports in FreeBSD

n

The values displayed in the sockstat output are described as:

n

    n

  • USER : The owner (user account) of the socket.
  • n

  • COMMAND : The command which with opened the socket.
  • n

  • PID : The process ID of the command which owns the socket.
  • n

  • FD : The file descriptor number of the socket.
  • n

  • PROTO : The transport protocol (usually TCP/UDP) associated with the opened socket or socket type in case of unix domain sockets (datagram, stream or seqpac) for UNIX sockets.
  • n

  • LOCAL ADDRESS : It represents the local IP address for IP based sockets. In case of Unix sockets it represents endpoint filename attached to the socket. The “??” notation implies that the socket endpoint could not be recognized or established.
  • n

  • FOREIGN ADDRESS : The remote IP address where the socket is connected to.
  • n

n

2. List Listening or Opened Ports in FreeBSD

n

Executed with the -l flag, sockstat command will display all listening sockets opened in the networking stack and all opened unix domain sockets or named pipes involved in some kind of local data processing in the system.

n

# sockstat -lrn

n

List Opened Network Ports
List Opened Network Ports

n

3. List IPv4 Opened Ports in FreeBSD

n

To display all opened sockets for IPv4 protocol only, issue the command with the -4 flag, as suggested in the below example.

n

# sockstat -4rn

n

List IPv4 Opened Ports in FreeBSD
List IPv4 Opened Ports in FreeBSD

n

4. List IPv6 Opened Ports in FreeBSD

n

Similar to IPv4 version, you can also display the opened network sockets for IPv6 only, by issuing the command as shown below.

n

# sockstat -6rn

n

List IPv6 Opened Ports
List IPv6 Opened Ports

n

5. List TCP or UDP Opened Ports in FreeBSD

n

In order to display network sockets based only on a specified network protocol, such as TCP or UDP, use the -P flag, followed by the argument name of the protocol.

n

The protocol names can be found by inspecting the content of the /etc/protocols file. Currently, the ICMP protocol is not supported by the sockstat tool.

n

Show only TCP sockets

n

# sockstat -P tcprn

n

List TCP Opened Ports
List TCP Opened Ports

n

Show only UDP sockets

n

# sockstat -P udprn

n

List UDP Opened Ports
List UDP Opened Ports

n

Chain both protocols.

n

# sockstat –P tcp,udprn

n

6. List TCP and UDP Specific Port Numbers

n

If you want to display all TCP or UDP IP opened sockets, based on the local or remote port number, use the below command flags and syntax, as illustrated in the below screenshot.

n

# sockstat -P tcp -p 443             [Show TCP HTTPS Port]rn# sockstat -P udp -p 53              [Show UDP DNS Port] rn# sockstat -P tcp -p 443,53,80,21    [Show Both TCP and UDP]rn

n

List Specific TCP Port
List Specific TCP Port

n

7. List Opened and Connected Ports in FreeBSD

n

In order to display all opened and connected sockets, use the -c flag. As shown in the below samples, you can list all HTTPS connected sockets or all TCP connected sockets by issuing the commands.

n

# sockstat -P tcp -p 443 -crn# sockstat -P tcp -crn

n

List Opened and Connected Ports
List Opened and Connected Ports

n

8. List Network Listening Ports in FreeBSD

n

To list all opened TCP sockets in listening state append the -l and -s flags, as shown in the below example. Being a connectionless protocol, UDP maintains no information about the state of the connection.

n

UDP opened sockets cannot be displayed by using their state, because the udp protocol uses datagrams to send/receive data and has no build-in mechanism to determine the state of the connection.

n

# sockstat -46 -l -srn

n

List Network Listening Ports
List Network Listening Ports

n

9. List Unix Sockets and Named Pipes

n

Unix domain sockets, as well as other forms of local inter-process communication, such as named pipes, can be displayed by sockstat command by using the -u flag, as shown in the below image.

n

# sockstat -urn

n

List Unix Sockets
List Unix Sockets

n

10. List Ports Opened by Application in FreeBSD

n

Sockstat command output can be filtered through grep utility in order to display a list of ports opened by a specific application or command.

n

Suppose you want to list all sockets associated with Nginx web server, you can issue the following command to achieve the task.

n

# sockstat -46 | grep nginxrn

n

List Application Listening Sockets
List Application Listening Sockets

n

To display only the connected sockets associated with Nginx web server, issue the following command.

n

# sockstat -46 -c| grep nginxrn

n

11. List HTTPS Connected Protocols

n

You can list all connected sockets associated with HTTPS protocol alongside the state of each connection by running the below command.

n

# sockstat -46 -s -P TCP -p 443 -crn

n

List HTTPS Connected Protocols
List HTTPS Connected Protocols

n

12. List HTTP Remote Sockets

n

To list all remote sockets associated with the HTTP protocol, you can run one of the following command combinations.

n

# sockstat -46 -c | egrep '80|443' | awk '{print $7}' | uniq -c | sort -nrrn# sockstat -46 -c -p 80,443 | grep -v ADDRESS|awk '{print $7}' | uniq -c | sort -nrrn

n

List Remote HTTP Protocols
List Remote HTTP Protocols

n

13. Find Highest HTTP Requests By IP Addresses

n

In case you want to find how many HTTP connections are requested by each remote IP address, issue the below command. This command can be very useful in case you want to determine if your web server is under some kind of DDOS attack. In case of suspicions, you should investigate the IP addresses with the highest request rate.

n

# sockstat -46 -c | egrep '80|443' | awk '{print $7}' | cut -d: -f1 | uniq -c | sort –nrrn

n

14. List DNS Opened Sockets

n

If you have configured a caching and forward DNS server at your premises to serve internal clients via TCP transport protocol and you want to display a list of all sockets
nopened by the resolver, along with the state of each socket connection, execute the following command.

n

# sockstat -46 -P tcp –p 53 -srn

n

List DNS Opened Sockets
List DNS Opened Sockets

n

15. Query TCP DNS on Local Domain

n

If there’s no DNS traffic on the network, you can manually trigger a DNS query on the TCP socket from the local machine’s console by running the following dig command. Afterwards, issue the above command to list all resolver sockets.

n

# dig +tcp  www.domain.com  @127.0.0.1rn

n

Query TCP DNS on Local
Query TCP DNS on Local

n

That’s all! Along with netstat and lsof command line utilities, sockstat command line is a powerful utility used for acquiring network information and troubleshoot multiple aspects of FreeBSD networking stack and networking related processes and services.

n

The FreeBSD sockstat command counterpart in Linux is represented by the netstat or the newly ss command. Believe it or not, based on sockstat utility, you can find a similar application developed for Android OS, named SockStat – Simple Netstat GUI.

n

‘]