Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

View programs' connections (open sockets) UNIX
I am a longtime FreeBSD advocate and network administrator, so being able to know what is communicating on my computers is a must. Much of FreeBSD is already deeply engrained into many modern operating systems, far more so in OS X. However, there is one program that I frequently used on FreeBSD that was not included in OSX: sockstat.

It took a few syntax changes to port it to OS X (view source), but it works exactly as it did in FreeBSD. sockstat is a Perl script which will present a list of programs to which are connected to or from you, and displays them in Terminal. This is useful because, at any given time, you can peek in to see if sshd, Apple Remote Desktop, or even Safari, etc., are connected.

Next time you start a service on your Mac with OS X, and you're not sure what port it happens to run on, try sockstat. Enjoy!

[robg adds: To use this script, first copy the text from the view source link, and then switch to Terminal. Open a new file for editing somewhere on your command path (/usr/local/bin, your user's ~/bin, etc.). Use vi or pico or whatever you're comfortable with (you could even paste it into TextEdit or antoher GUI editor). Once pasted, save the file as sockstat, make it executable with chmod +x sockstat, and then type hash to tell the bash shell to find new programs. I tested it, and it works as described -- use the linked man page above for instructions, as the help is not included with this source.]
    •    
  • Currently 3.00 / 5
  • 1
  • 2
  • 3
  • 4
  • 5
  (2 votes cast)
 
[14,387 views]  

View programs' connections (open sockets) | 14 comments | Create New Account
Click here to return to the 'View programs' connections (open sockets)' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
View programs' connections (open sockets)
Authored by: zimmerleut on Mar 21, '05 10:39:17AM

The link to the source code appears to be dead.

j.



[ Reply to This | # ]
Downloadable Link.
Authored by: tanawts on Mar 21, '05 11:36:59AM

My Appologies for not including the link and the instructions:
http://snowcrash.hbtk.net/sockstat

Also as previously noted: To use the on the command line system wide, you will want to move the file into /usr/sbin.

Download to your homedir.
Open Terminal.app
mv ~/sockstat /usr/sbin

then type sockstat to run the program.



[ Reply to This | # ]
Downloadable Link.
Authored by: digitaldelight on Mar 21, '05 11:41:58AM
As noted below sockstat is also available through various other sources (e.g. Fink and Darwinports)...

[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: balakera on Mar 21, '05 10:39:57AM

Unfortunately, source link is not working.



[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: balakera on Mar 21, '05 11:01:57AM

I have just checked my Darwinports install and sockstat is available there.
just issue "sudo port install sockstat" and 1 minute later you'll have it up and running with man pages available.



[ Reply to This | # ]
Fink too
Authored by: lullabud on Mar 21, '05 12:58:09PM

Fink has it too. `sudo fink install sockstat`



[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: hrbrmstr on Mar 21, '05 11:20:20AM

lsof -r -i TCP -i UDP

will do the same and repeat the process endlessly (remove "-r" to do it once).

Should be on every box, but you might need to install fink first.

---
Mind the gap...



[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: ershler on Mar 21, '05 12:25:47PM

I like this one a lot. Thanks for the hint.

Phil



[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: msk on Mar 21, '05 02:32:04PM

lsof -r -i TCP -i UDP

and

sockstat

generate completely different output. Big difference between sockets and ports.



[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: hrbrmstr on Mar 21, '05 04:00:02PM

they both provide the same info with the correct options. I listed three (for brevity). lsof shows all file descriptors...socket==file descriptor. so, in fact, lsof is a more robust tool.

lsof rocks. folks who can't type "man lsof" before posting replies don't...

---
Mind the gap...



[ Reply to This | # ]
Even easier...
Authored by: jtrott on Mar 21, '05 10:38:14PM

Try lsof -i4
Or lsof -6 for TCPv6 connections.



[ Reply to This | # ]
Minor tweak...
Authored by: MattHaffner on Mar 22, '05 03:43:19PM

You'll want to run this with root permissions ('sudo lsof...') if you want to see all the connections on your machine. As a user, it only shows connections opened by processes started by your user ID.



[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: thegfunk on Mar 22, '05 01:40:11AM

GeekTool and either this script or the lsof (I'm using lsof -i4) make an excellent little monitor for whats going on network-wise on the desktop...



[ Reply to This | # ]
View programs' connections (open sockets)
Authored by: TigerKR on Apr 01, '05 09:03:33PM

To monitor external (other computers/network devices) connections, I like to use:

sudo lsof -i4 | grep -v localhost

I added the grep part because I don't really care about internal (my computer talking to itsself) connections.

This command came in very handy when recently I freaked myself out because I did an:

sudo ipfw show

on the machine that I use as a firewall/natd/dhcp server for the LAN, and I found a whole boatload of https/443 connections I couldn't (immediately) identify. I panicked and looked at all of the connections from the computers on the LAN, and then did an nslookup for the IP in question (that was associated with most of the https/443 connections). It turns out that the entries were remnants on ipfw's "established" list and they were from an online banking transaction that I had conducted earlier in the day.



[ Reply to This | # ]