#sockstat
LightNews LightNews
vermaden.bsky.social
New 𝗖𝗿𝘂𝗰𝗶𝗮𝗹 𝗙𝗿𝗲𝗲𝗕𝗦𝗗 𝗧𝗼𝗼𝗹𝗸𝗶𝘁 [Crucial FreeBSD Toolkit] article on the blog.

vermaden.wordpress.com/2025/07/08/c...

#verblog #beadm #bectl #devfs #diskinfo #free #freebsd #fstab #gstat #jails #linux #lsblk #sensors #sockstat #systat #tar #truss #truncate #zfs
July 8, 2025 at 8:39 PM
larvitz.burningboard.net.ap.brid.gy
Just published a comprehensive FreeBSD Cheat Sheet for Linux Admins!

Covers all the essentials:
- Hardware info (pciconf → lspci)
- Network commands (sockstat is amazing!)
- Disk management & ZFS operations
- Service management differences
- Package management across systems

Perfect for Linux […]
Original post on burningboard.net
burningboard.net
August 29, 2025 at 7:49 PM
larvitz.burningboard.net.ap.brid.gy
New post: FreeBSD resource monitoring and accounting.

A practical tour of the base-system toolkit for figuring out *what is actually using my server*: top, vmstat, systat, gstat, netstat/sockstat, procstat, pfctl, and per-jail attribution with kern.racct and rctl.

No ports, no agents. Just […]
Original post on burningboard.net
burningboard.net
May 12, 2026 at 7:50 AM
freebsd.activitypub.awakari.com.ap.brid.gy
sockstat: with -A print pcb addresses, just like netstat(1)

http://cgit.freebsd.org/src/commit/?id=9f55128fecb5b5eb8e8fffa5b65d38255762d176

Event Attributes
src - FreeBSD source tree
cgit.freebsd.org
February 11, 2025 at 6:33 PM
freebsd.activitypub.awakari.com.ap.brid.gy
sockstat: use bool for flags No functional change.

http://cgit.freebsd.org/src/commit/?id=01a46c7dc002bb4d2a35bdcebf0ed194846bfe01

Event Attributes
src - FreeBSD source tree
cgit.freebsd.org
February 11, 2025 at 6:33 PM
fm-volker.mastodon.social.ap.brid.gy
Somehow I can't compile `lsof` on #opnsense anymore...I finally remembered that @des long ago came up with `sockstat` on FreeBSD! Turns out to be totally sufficient for my purposes, just lacks nailing down the PID instead of grepping it afterwards.
October 8, 2024 at 10:12 AM
linux.activitypub.awakari.com.ap.brid.gy
pull pushed fluent-bit pull[bot] bot pushed to master in Spencerx/fluent-bit · August 11, 2025 02:02 1 commit to master 9660e36 in_node_exporter_metrics: add Linux sockstat collector

Origin | Interest | Match
Comparing 4e62817d81...9660e36f54 · Spencerx/fluent-bit
Fast and Lightweight Log processor and forwarder for Linux, BSD and OSX - Comparing 4e62817d81...9660e36f54 · Spencerx/fluent-bit
github.com
August 11, 2025 at 2:08 AM
meangrape.com
Why doesn’t macOS have sockstat? And, no, I don’t want to use lsof—it has too many command line options to remember; I always have to read the man page to use it
October 20, 2024 at 12:42 PM
stefanrink.bsky.social
Nah, they already made a bunch of replacements.

Same as sockstat, netstat, ipconfig and route.

Why keep standards and just update them when you can make a bunch of new tools instead? 👍
October 15, 2024 at 9:32 PM
forums.freebsd.org.web.brid.gy
Why is port 992 open ?
I've done a fresh install of 14.2 with kde/plasma6. (Slowly becoming familiar with lotsa stuff thats been moved to different place/s.) Curious to know how port 992 becomes open. If not needed, how to close it ? Code: # sockstat -l | grep 992 ? ? ? ? tcp4 *:992 *:*
forums.FreeBSD.org
April 22, 2025 at 4:39 AM
forums.freebsd.org.web.brid.gy
Why do I have entries at the end of sockstat not associated to any service?
While debugging a jail configuration I have noticed the existence of 4 "services" that I can not manage to identify, namely the last 4 lines in this listing: Code: # sockstat -4 -l USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root sshd 2363 3 tcp4 *:22 *:* root nfsd 2334 5 tcp4 *:2049 *:* root mountd 2318 9 udp4 *:773 *:* root mountd 2318 10 tcp4 *:773 *:* daemon rwhod 2282 4 udp4 *:513 *:* daemon rwhod 2280 4 udp4 *:513 *:* root rpc.statd 2250 6 udp4 *:713 *:* root rpc.statd 2250 7 tcp4 *:713 *:* root rpcbind 2248 9 udp4 *:111 *:* root rpcbind 2248 10 udp4 *:739 *:* root rpcbind 2248 11 tcp4 *:111 *:* root syslogd 2208 7 udp4 *:514 *:* ? ? ? ? udp4 *:* *:* ? ? ? ? udp4 *:1015 *:* ? ? ? ? tcp4 *:994 *:* ? ? ? ? udp4 *:2049 *:* I identify all others with existing configured services (NFS, RWHO, SSH and SYSLOG). Why do I see those four lines at the bottom of sockstat?
forums.FreeBSD.org
March 3, 2025 at 4:41 PM
forums.freebsd.org.web.brid.gy
Why do I have entries at the end of sockstat not associated to any service?
While debugging a jail configuration I have noticed the existence of 4 "services" that I can not manage to identify, namely the last 4 lines in this listing: ` ` # sockstat -4 -l USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root sshd 2363 3 tcp4 *:22 *:* root nfsd 2334 5 tcp4 *:2049 *:* root mountd 2318 9 udp4 *:773 *:* root mountd 2318 10 tcp4 *:773 *:* daemon rwhod 2282 4 udp4 *:513 *:* daemon rwhod 2280 4 udp4 *:513 *:* root rpc.statd 2250 6 udp4 *:713 *:* root rpc.statd 2250 7 tcp4 *:713 *:* root rpcbind 2248 9 udp4 *:111 *:* root rpcbind 2248 10 udp4 *:739 *:* root rpcbind 2248 11 tcp4 *:111 *:* root syslogd 2208 7 udp4 *:514 *:* ? ? ? ? udp4 *:* *:* ? ? ? ? udp4 *:1015 *:* ? ? ? ? tcp4 *:994 *:* ? ? ? ? udp4 *:2049 *:* `` I identify all others with existing configured services (NFS, RWHO, SSH and SYSLOG). Why do I see those four lines at the bottom of sockstat?
forums.FreeBSD.org
February 28, 2025 at 4:36 PM
forums.freebsd.org.web.brid.gy
rkhunter issues after update
Hi all, I`ve updated rkhunter yesterday the new port deleted my old configuration and now I`m getting some strange reports: Code: FreeBSD wolfdale 8.1-RELEASE-p1 FreeBSD 8.1-RELEASE-p1 #0: Sun Oct 10 15:57:09 EEST 2010 Rootkit Hunter 1.3.8 Code: Warning: Differences found between sockstat and netstat output: Sockstat output (ports in use): 139 2094 2095 21 22 25 3306 445 47763 80 Netstat output (ports in use): 139 2094 2095 21 22 25 3306 445 80 I looked into this "new" port 47763 and found it was not even a port Code: [root@wolfdale ~/scripts]# netstat -an | grep 47763 ffffff005e78db40 stream 0 0 ffffff000b6e9000 0 0 0 /tmp/ssh-kbxohRioPN/agent.47763 [root@wolfdale ~/scripts]# sockstat -p 47763 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS click sshd 47763 4 stream -> ?? click sshd 47763 9 stream /tmp/ssh-kbxohRioPN/agent.47763 root sshd 47761 5 stream -> ?? root cron 15312 4 dgram -> /var/run/logpriv root syslogd 15167 4 dgram /var/run/log root syslogd 15167 5 dgram /var/run/logpriv 88 mysqld 15088 14 stream /tmp/mysql.sock root cron 14818 4 dgram -> /var/run/logpriv root syslogd 14621 4 dgram /var/run/log root syslogd 14621 5 dgram /var/run/logpriv root cron 14475 4 dgram -> /var/run/logpriv root syslogd 14338 4 dgram /var/run/log root syslogd 14338 5 dgram /var/run/logpriv root cron 14189 4 dgram -> /var/run/logpriv root syslogd 14044 4 dgram /var/run/log root syslogd 14044 5 dgram /var/run/logpriv root cron 13896 4 dgram -> /var/run/logpriv root syslogd 13756 4 dgram /var/run/log root syslogd 13756 5 dgram /var/run/logpriv root cron 3173 5 dgram -> /var/run/logpriv smmsp sendmail 3166 3 dgram -> /var/run/log root sendmail 3162 3 dgram -> /var/run/logpriv root monit 1184 3 dgram -> /var/run/logpriv root syslogd 1042 4 dgram /var/run/log root syslogd 1042 5 dgram /var/run/logpriv root devd 859 6 stream /var/run/devd.pipe _pflogd pflogd 557 5 stream -> ?? root pflogd 554 4 stream -> ?? root pflogd 554 5 dgram -> /var/run/logpriv Is that issue observed only by me, maybe I missconfigured something? Is it normal portupgrade to delete the old configuration file?
forums.FreeBSD.org
February 16, 2025 at 4:04 PM