Zlexis
02/17/2020, 8:52 PMsudo ls /proc/12345/fd
where 12345 is a process ID. Why is this command considered an outbound connection?seph
02/17/2020, 9:04 PMZlexis
02/17/2020, 9:18 PMSELECT user.username, proc.name, hash.md5, socket.pid, proc.path, proc.cmdline, socket.local_port, socket.remote_port, socket.remote_address FROM process_open_sockets as socket, processes as proc, users as user, hash as hash where socket.local_port not in (select port from listening_ports) and socket.local_port != 0 and socket.pid = proc.pid and user.uid = proc.uid and hash.path = proc.path;
seph
02/17/2020, 9:27 PMZlexis
02/17/2020, 10:37 PMseph
02/18/2020, 3:06 AMprocess_open_sockets
and listening_ports
have columns for family. The meaning there is os dependent.