filetrace connections: open and recently closed sockets

Reference for filetrace connections: sockets by their local and remote ends, owning process, state and byte counts, with every option, examples and exit codes.

filetrace connections lists the open and recently closed sockets, most recently active first, with the process that owns each, its state and the bytes it sent and received. The SOCKET column gives the ID that inspect socket takes.

​

Usage

filetrace connections [options]

​

What it shows

sudo filetrace connections --limit 8

PID   PROCESS         PROTOCOL  LOCAL              REMOTE              STATE           SENT  RECEIVED  SOCKET
1026  file-server     TCP       127.0.0.1:51871    127.0.0.1:41814     ESTABLISHED      0 B   15.5 MB      17
1024  file-server     TCP       127.0.0.1:41814    127.0.0.1:51871     ESTABLISHED  15.5 MB       0 B      16
1024  file-server     TCP       127.0.0.1:51871    *                   LISTENING        0 B       0 B      15
152   metrics-daemon  TCP       192.168.65.7:2376  192.168.65.1:25374  ESTABLISHED    473 B       0 B    4097
1023  file-server     UDP       127.0.0.1:45789    *                   ACTIVE           0 B   48.8 KB    8193
1022  file-server     UDP       0.0.0.0:49570      127.0.0.1:45789     ACTIVE       48.8 KB       0 B      14
1020  file-server     TCP       127.0.0.1:40477    *                   CLOSED           0 B       0 B      11
1021  file-server     TCP       127.0.0.1:40477    127.0.0.1:49084     CLOSED           6 B    195 KB      13

Observed since 2026-11-11 20:07:55. History is not kept across agent restarts.

Column	Meaning
PID, PROCESS	The process that owns the socket
PROTOCOL	TCP or UDP
LOCAL, REMOTE	The two ends as this machine sees them. For a server, the remote end is the client. * marks an end that is not set, such as the remote end of a listening socket.
STATE	The socket’s state, described below
SENT	Bytes the socket accepted
RECEIVED	Bytes the socket delivered
SOCKET	The socket ID

The owning process of an accepted connection is known once it sends or receives on it; until then PID shows -.

State	Meaning
CONNECTING	A TCP connection being set up
ESTABLISHED	An established TCP connection
LISTENING	A TCP socket waiting for connections
CLOSED	A closed socket
ACTIVE	A UDP socket with traffic within the last 30 seconds
IDLE	A UDP socket without traffic for 30 seconds

A closed socket stays listed for 60 seconds after it closes. With --since or --state closed, closed sockets are listed for as long as the agent remembers them.

​

Options

--active · boolean

Only sockets that are open: not closed and not idle.

--pid · number

Only this process.

--process · string

Only processes with this name. * matches any run of characters. Alias: --name.

--user · string

Only processes of this user, by name or numeric ID.

--cgroup · string

Only processes in this cgroup, by numeric ID or cgroup directory.

--namespace · number

Only processes in this network, PID or mount namespace, given as the inode number that ls -Li /proc/<pid>/ns shows.

--remote · string

Only this remote address or CIDR network.

--local · string

Only this local address or CIDR network.

--port · number

Only this local or remote port.

--protocol · string · default: "all"

Only this protocol: tcp, udp or all.

--family · string

Only this address family: ipv4 or ipv6.

--state · string

connecting, established, listening, closed, active or idle.

--since · string

Only sockets active at or after this time: a duration such as 10m, 1h or 7d, or an RFC 3339 timestamp.

--until · string

Only sockets first seen at or before this time.

--sort · string

outbound, inbound, bytes, time, pid, rate, duration or process. outbound and inbound order by bytes sent or received, rate by the current rate in both directions. Without it, the most recently active come first.

--resolve-hostnames · boolean

Show remote addresses by host name where a reverse DNS lookup finds one. The lookups tell the DNS resolver which addresses are being looked at.

--limit · number

Show at most this many rows.

--format · string · default: "table"

table, json, jsonl, csv or quiet. Quiet prints one socket ID per row.

--json · boolean

Short for --format json.

--jsonl · boolean

Short for --format jsonl.

--output · string

Write to this file instead of standard output.

Byte counts cover a record’s whole observed lifetime; --since and --until select which records are listed. See filters and output formats.

​

Examples

filetrace connections --protocol tcp
filetrace connections --remote 203.0.113.42
filetrace connections --pid 1842 --state established

Machine-readable output adds the current rates and when the socket was first and last seen:

sudo filetrace connections --json --limit 2

[
 {"socket_id":17,"protocol":"tcp","pid":1026,"process":"file-server","local_ip":"127.0.0.1","local_port":51871,"remote_ip":"127.0.0.1","remote_port":41814,"state":"established","bytes_sent":0,"bytes_received":16250000,"bytes_sent_per_second":0,"bytes_received_per_second":4217235,"first_seen":"2026-11-11T20:07:56.193Z","last_seen":"2026-11-11T20:07:59.515Z"},
 {"socket_id":16,"protocol":"tcp","pid":1024,"process":"file-server","local_ip":"127.0.0.1","local_port":41814,"remote_ip":"127.0.0.1","remote_port":51871,"state":"established","bytes_sent":16250000,"bytes_received":0,"bytes_sent_per_second":4217235,"bytes_received_per_second":0,"first_seen":"2026-11-11T20:07:56.193Z","last_seen":"2026-11-11T20:07:59.514Z"}
]

To look at one socket with its flows and the files sent on it, pass its ID to inspect:

sudo filetrace inspect socket 17

flows splits the bytes of a socket by process and remote endpoint.

​

Exit codes

Code	Meaning
0	Success
1	General error
2	Invalid arguments
3	Permission denied: the agent socket is not accessible to this user
4	No agent is running
5	Unsupported platform or capability
6	The configuration file cannot be read or is invalid
9	Partial results: events were lost in the queried time range