Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

listening_ports

Processes with listening (bound) network sockets/ports.

Column	Type	Description
address	text	Specific address for bind
family	integer	Network protocol (IPv4, IPv6)
fd	bigint	Socket file descriptor number
net_namespace	text	The inode number of the network namespace Only available on Linux
path	text	Path for UNIX domain sockets
pid	integer	Process (or thread) ID
port	integer	Transport layer port
protocol	integer	Transport protocol (TCP/UDP)
socket	bigint	Socket handle or inode number

List executables listening on network ports.

SELECT l.port, l.pid, p.name, p.path FROM listening_ports l JOIN processes p USING (pid);

Edit page

Ask us anything

Solutions Device management Orchestration Software management Integrations Pricing

Documentation Support Docs API Release notes Get your license

Company About Trust Jobs Logos/artwork Why open source?

SOC2 Type 2