search

droe / xnumon

monitor macOS for malicious activity
https://www.roe.ch/xnumon
Open Software License 3.0
230 stars 30 forks source link

Add local addr:port to socket-accept[6] and socket-connect[7] events #38

Closed droe closed 6 years ago

droe commented 6 years ago

14 introduced initial socket events which each log a single addr:port tuple. Track the locally bound addr:port per socket in sockmon in order to also log the bindaddr:bindport tuple in socket-accept[6] and socket-connect[7].

droe commented 6 years ago

Related to #37

droe commented 6 years ago

This is only partially possible without resorting to run-time state lookups; what is possible by tracking the sockets API has been implemented.