Looking at the source code and documentation, it seems like the linux socket_events look at bind() and connect() respectively, and for bind() it sets raddr and rport to 0 by default and for connect() it sets laddr, lport to 0 by default. Is it impossible to get local address and port from syscall connect() for linux? https://github.com/facebook/osquery/blob/0314871908273b2770129da9f5a7c3206f224f68/osquery/tables/events/linux/socket_events.cpp#L62