Divya
01/04/2022, 1:29 PMkoo
01/04/2022, 5:11 PMDivya
01/04/2022, 5:21 PMseph
01/05/2022, 2:11 AMprocess_open_sockets
table? https://osquery.io/schema/5.0.1#process_open_socketsDivya
01/05/2022, 4:07 AMnetstat -ntlp | grep -vEe "\s+127[.]|::1"
seph
01/05/2022, 11:41 AMDivya
01/06/2022, 5:25 AMnetstat -ntlp | grep -vEe "\s+127[.]|::1"
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:3943 0.0.0.0:* LISTEN 12080/nginx: master
tcp 0 0 0.0.0.0:2222 0.0.0.0:* LISTEN 984/sshd
tcp 0 0 0.0.0.0:6002 0.0.0.0:* LISTEN 2414/X
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2796/sshd
tcp 0 0 0.0.0.0:3939 0.0.0.0:* LISTEN 12080/nginx: master
tcp 0 0 0.0.0.0:3940 0.0.0.0:* LISTEN 12080/nginx: master
tcp 0 0 0.0.0.0:3942 0.0.0.0:* LISTEN 12080/nginx: master
tcp6 0 0 :::3944 :::* LISTEN 12027/till-discover
tcp6 0 0 :::31337 :::* LISTEN 7746/docker-proxy
tcp6 0 0 :::2222 :::* LISTEN 984/sshd
tcp6 0 0 :::6002 :::* LISTEN 2414/X
tcp6 0 0 :::22 :::* LISTEN 2796/sshd
tcp6 0 0 :::8087 :::* LISTEN 7498/docker-proxy
tcp6 0 0 :::8888 :::* LISTEN 27851/docker-proxy
tcp6 0 0 :::9369 :::* LISTEN 12051/pushprox-clie
tcp6 0 0 :::8093 :::* LISTEN 10615/docker-proxy
tcp6 0 0 :::8095 :::* LISTEN 15096/docker-proxy
tcp6 0 0 :::3941 :::* LISTEN 12066/prometheus
select distinct port from listening_ports where address='0.0.0.0' and protocol=6;
I see 106 and ports. An example is port 3000. I am wondering if it is blocked at the iptables level and is there a way I can filter using that tableseph
01/06/2022, 4:43 PMDivya
01/10/2022, 4:52 AMosquery> select * from listening_ports where port=2222;
+-----+------+----------+--------+---------+----+--------+------+---------------+
| pid | port | protocol | family | address | fd | socket | path | net_namespace |
+-----+------+----------+--------+---------+----+--------+------+---------------+
| 971 | 2222 | 6 | 2 | 0.0.0.0 | 3 | 24323 | | 4026531956 |
| 971 | 2222 | 6 | 10 | :: | 4 | 24325 | | 4026531956 |
+-----+------+----------+--------+---------+----+--------+------+---------------+
osquery> select * from listening_ports where port=6127;
+------+------+----------+--------+-----------+----+--------+------+---------------+
| pid | port | protocol | family | address | fd | socket | path | net_namespace |
+------+------+----------+--------+-----------+----+--------+------+---------------+
| 5946 | 6127 | 6 | 2 | 127.0.0.1 | 4 | 56796 | | 4026531956 |
| 7186 | 6127 | 6 | 2 | 0.0.0.0 | 19 | 112366 | | 4026534232 |
+------+------+----------+--------+-----------+----+--------+------+---------------+
seph
01/10/2022, 7:06 PMDivya
01/11/2022, 5:16 AMseph
01/11/2022, 12:48 PMDivya
01/12/2022, 9:38 AMseph
01/12/2022, 2:42 PM6127
for example. Can you provide the osquery output for it, and the netstat output for it. Make sure both commands are running as root.