Sockstat is a versatile command line utility used for displaying network and system opened sockets in FreeBSD. Mainly, sockstat command is installed by default in FreeBSD and it’s commonly used for displaying the name of the processes who opened a certain network port on a FreeBSD system.
However, sockstat can also list open sockets based on protocol version (both IP versions), on the state of the connection and on what ports a daemon or a program binds and listens on.
It can also display inter-process communication sockets, typically known as Unix domain sockets or IPC. Sockstat command combined with grep filter or piped through awk utility proves to be a powerful tool for the local networking stack.
It can shrink the results for an opened connection based on the user who owns the socket, the file descriptor of a network socket or the PID of the process who opened the socket.
Requirements
FreeBSD 11.1 Installation Guide
1. List All Opened Ports in FreeBSD
Simply executed without any options or switches, sockstat command will display all opened sockets in a FreeBSD system, as illustrated in the below screenshot.
# sockstat
The values displayed in the sockstat output are described as:
USER : The owner (user account) of the socket.
COMMAND : The command which with opened the socket.
PID : The process ID of the command which owns the socket.
FD : The file descriptor number of the socket.
PROTO : The transport protocol (usually TCP/UDP) associated with the opened socket or socket type in case of unix domain sockets (datagram, stream or seqpac) for UNIX sockets.
LOCAL ADDRESS : It represents the local IP address for IP based sockets. In case of Unix sockets it represents endpoint filename attached to the socket. The “??” notation implies that the socket endpoint could not be recognized or established.
FOREIGN ADDRESS : The remote IP address where the socket is connected to.
2. List Listening or Opened Ports in FreeBSD
Executed with the -l flag, sockstat command will display all listening sockets opened in the networking stack and all opened unix domain sockets or named pipes involved in some kind of local data processing in the system.
# sockstat -l
3. List IPv4 Opened Ports in FreeBSD
To display all opened sockets for IPv4 protocol only, issue the command with the -4 flag, as suggested in the below example.
# sockstat -4
4. List IPv6 Opened Ports in FreeBSD
Similar to IPv4 version, you can also display the opened network sockets for IPv6 only, by issuing the command as shown below.
# sockstat -6
5. List TCP or UDP Opened Ports in FreeBSD
In order to display network sockets based only on a specified network protocol, such as TCP or UDP, use the -P flag, followed by the argument name of the protocol.
The protocol names can be found by inspecting the content of the /etc/protocols file. Currently, the ICMP protocol is not supported by the sockstat tool.
Show only TCP sockets
# sockstat -P tcp
Show only UDP sockets
# sockstat -P udp
Chain both protocols.
# sockstat –P tcp,udp
6. List TCP and UDP Specific Port Numbers
If you want to display all TCP or UDP IP opened sockets, based on the local or remote port number, use the below command flags and syntax, as illustrated below.
# sockstat -P tcp -p 443 [Show TCP HTTPS Port] # sockstat -P udp -p 53 [Show UDP DNS Port] # sockstat -P tcp -p 443,53,80,21 [Show Both TCP and UDP]
7. List Opened and Connected Ports in FreeBSD
In order to display all opened and connected sockets, use the -c flag. As shown in the below samples, you can list all HTTPS connected sockets or all TCP connected sockets by issuing the commands.
# sockstat -P tcp -p 443 -c
# sockstat -P tcp -c
8. List Network Listening Ports in FreeBSD
To list all opened TCP sockets in listening state append the -l and -s flags, as shown in the below example. Being a connectionless protocol, UDP maintains no information about the state of the connection.
UDP opened sockets cannot be displayed by using their state, because the udp protocol uses datagrams to send/receive data and has no build-in mechanism to determine the state of the connection.
# sockstat -46 -l -s
9. List Unix Sockets and Named Pipes
Unix domain sockets, as well as other forms of local inter-process communication, such as named pipes, can be displayed by sockstat command by using the -u flag, as shown in the below image.
# sockstat -u
10. List Ports Opened by Application in FreeBSD
Sockstat command output can be filtered through grep utility in order to display a list of ports opened by a specific application or command.
Suppose you want to list all sockets associated with Nginx web server, you can issue the following command to achieve the task.
# sockstat -46 | grep nginx
To display only the connected sockets associated with Nginx web server, issue the following command.
# sockstat -46 -c| grep nginx
11. List HTTPS Connected Protocols
You can list all connected sockets associated with HTTPS protocol alongside the state of each connection by running the below command.
# sockstat -46 -s -P TCP -p 443 -c
12. List HTTP Remote Sockets
To list all remote sockets associated with the HTTP protocol, you can run one of the following command combinations.
# sockstat -46 -c | egrep '80|443' | awk '{print $7}' | uniq -c | sort -nr
# sockstat -46 -c -p 80,443 | grep -v ADDRESS|awk '{print $7}' | uniq -c | sort -nr
13. Find Highest HTTP Requests By IP Addresses
In case you want to find how many HTTP connections are requested by each remote IP address, issue the below command. This command can be very useful in case you want to determine if your web server is under some kind of DDOS attack. In case of suspicions, you should investigate the IP addresses with the highest request rate.
# sockstat -46 -c | egrep '80|443' | awk '{print $7}' | cut -d: -f1 | uniq -c | sor –nr
14. List DNS Opened Sockets
If you have configured a caching and forward DNS server at your premises to serve internal clients via TCP transport protocol and you want to display a list of all sockets
opened by the resolver, along with the state of each socket connection, execute the following command.
# sockstat -46 -P tcp –p 53 -s
15. Query TCP DNS on Local Domain
If there’s no DNS traffic on the network, you can manually trigger a DNS query on the TCP socket from the local machine’s console by running the following dig command. Afterwards, issue the above command to list all resolver sockets.
# dig +tcp www.domain.com @127.0.0.1
