Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
listening_ports
listening_ports
Processes with listening (bound) network sockets/ports.
| Column | Type | Description |
|---|---|---|
| address | text | Specific address for bind |
| family | integer | Network protocol (IPv4, IPv6) |
| fd | bigint | Socket file descriptor number |
| net_namespace | text | The inode number of the network namespace Only available on Linux |
| path | text | Path for UNIX domain sockets |
| pid | integer | Process (or thread) ID |
| port | integer | Transport layer port |
| protocol | integer | Transport protocol (TCP/UDP) |
| socket | bigint | Socket handle or inode number |
Example
List executables listening on network ports.
SELECT l.port, l.pid, p.name, p.path FROM listening_ports l JOIN processes p USING (pid);
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
