lets say I'd like to do netstat-like on OSX: osqueryi "select pr.name AS protocol, pos.local_address || ':' || pos.local_port AS 'Local Address', pos.remote_address || ':' || pos.remote_port AS 'Foreign Address', p.pid || '/' || p.name AS 'PID/Program name' FROM process_open_sockets AS pos JOIN processes AS p ON p.pid = pos.pid JOIN etc_protocols pr ON pos.protocol = pr.number WHERE (pos.path <> '' OR pos.remote_address <> '') AND (pr.number = 6 OR pr.number = 17) AND pos.local_port > 0 ORDER BY pos.family, pos.local_address;"