> ## Documentation Index > Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # filetrace connections: open and recently closed sockets > Reference for filetrace connections: sockets by their local and remote ends, owning process, state and byte counts, with every option, examples and exit codes. `filetrace connections` lists the open and recently closed sockets, most recently active first, with the process that owns each, its state and the bytes it sent and received. The SOCKET column gives the ID that [`inspect socket`](https://filetrace.mintlify.site/cli/inspect) takes. ## Usage ```bash theme={null} filetrace connections [options] ``` ## What it shows ```bash theme={null} sudo filetrace connections --limit 8 ``` ```text theme={null} PID PROCESS PROTOCOL LOCAL REMOTE STATE SENT RECEIVED SOCKET 1026 file-server TCP 127.0.0.1:51871 127.0.0.1:41814 ESTABLISHED 0 B 15.5 MB 17 1024 file-server TCP 127.0.0.1:41814 127.0.0.1:51871 ESTABLISHED 15.5 MB 0 B 16 1024 file-server TCP 127.0.0.1:51871 * LISTENING 0 B 0 B 15 152 metrics-daemon TCP 192.168.65.7:2376 192.168.65.1:25374 ESTABLISHED 473 B 0 B 4097 1023 file-server UDP 127.0.0.1:45789 * ACTIVE 0 B 48.8 KB 8193 1022 file-server UDP 0.0.0.0:49570 127.0.0.1:45789 ACTIVE 48.8 KB 0 B 14 1020 file-server TCP 127.0.0.1:40477 * CLOSED 0 B 0 B 11 1021 file-server TCP 127.0.0.1:40477 127.0.0.1:49084 CLOSED 6 B 195 KB 13 Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` | Column | Meaning | | - | - | | PID, PROCESS | The process that owns the socket | | PROTOCOL | `TCP` or `UDP` | | LOCAL, REMOTE | The two ends as this machine sees them. For a server, the remote end is the client. `*` marks an end that is not set, such as the remote end of a listening socket. | | STATE | The socket's state, described below | | SENT | Bytes the socket accepted | | RECEIVED | Bytes the socket delivered | | SOCKET | The socket ID | The owning process of an accepted connection is known once it sends or receives on it; until then PID shows `-`. | State | Meaning | | - | - | | CONNECTING | A TCP connection being set up | | ESTABLISHED | An established TCP connection | | LISTENING | A TCP socket waiting for connections | | CLOSED | A closed socket | | ACTIVE | A UDP socket with traffic within the last 30 seconds | | IDLE | A UDP socket without traffic for 30 seconds | A closed socket stays listed for 60 seconds after it closes. With `--since` or `--state closed`, closed sockets are listed for as long as the agent remembers them. ## Options **--active** `boolean` Only sockets that are open: not closed and not idle. **--pid** `number` Only this process. **--process** `string` Only processes with this name. `*` matches any run of characters. Alias: `--name`. **--user** `string` Only processes of this user, by name or numeric ID. **--cgroup** `string` Only processes in this cgroup, by numeric ID or cgroup directory. **--namespace** `number` Only processes in this network, PID or mount namespace, given as the inode number that `ls -Li /proc//ns` shows. **--remote** `string` Only this remote address or CIDR network. **--local** `string` Only this local address or CIDR network. **--port** `number` Only this local or remote port. **--protocol** `string` (default: all) Only this protocol: `tcp`, `udp` or `all`. **--family** `string` Only this address family: `ipv4` or `ipv6`. **--state** `string` `connecting`, `established`, `listening`, `closed`, `active` or `idle`. **--since** `string` Only sockets active at or after this time: a duration such as `10m`, `1h` or `7d`, or an RFC 3339 timestamp. **--until** `string` Only sockets first seen at or before this time. **--sort** `string` `outbound`, `inbound`, `bytes`, `time`, `pid`, `rate`, `duration` or `process`. `outbound` and `inbound` order by bytes sent or received, `rate` by the current rate in both directions. Without it, the most recently active come first. **--resolve-hostnames** `boolean` Show remote addresses by host name where a reverse DNS lookup finds one. The lookups tell the DNS resolver which addresses are being looked at. **--limit** `number` Show at most this many rows. **--format** `string` (default: table) `table`, `json`, `jsonl`, `csv` or `quiet`. Quiet prints one socket ID per row. **--json** `boolean` Short for `--format json`. **--jsonl** `boolean` Short for `--format jsonl`. **--output** `string` Write to this file instead of standard output. Byte counts cover a record's whole observed lifetime; `--since` and `--until` select which records are listed. See [filters](https://filetrace.mintlify.site/cli/filters.md) and [output formats](https://filetrace.mintlify.site/cli/output-formats.md). ## Examples ```bash theme={null} filetrace connections --protocol tcp filetrace connections --remote 203.0.113.42 filetrace connections --pid 1842 --state established ``` Machine-readable output adds the current rates and when the socket was first and last seen: ```bash theme={null} sudo filetrace connections --json --limit 2 ``` ```json theme={null} [ {"socket_id":17,"protocol":"tcp","pid":1026,"process":"file-server","local_ip":"127.0.0.1","local_port":51871,"remote_ip":"127.0.0.1","remote_port":41814,"state":"established","bytes_sent":0,"bytes_received":16250000,"bytes_sent_per_second":0,"bytes_received_per_second":4217235,"first_seen":"2026-11-11T20:07:56.193Z","last_seen":"2026-11-11T20:07:59.515Z"}, {"socket_id":16,"protocol":"tcp","pid":1024,"process":"file-server","local_ip":"127.0.0.1","local_port":41814,"remote_ip":"127.0.0.1","remote_port":51871,"state":"established","bytes_sent":16250000,"bytes_received":0,"bytes_sent_per_second":4217235,"bytes_received_per_second":0,"first_seen":"2026-11-11T20:07:56.193Z","last_seen":"2026-11-11T20:07:59.514Z"} ] ``` To look at one socket with its flows and the files sent on it, pass its ID to `inspect`: ```bash theme={null} sudo filetrace inspect socket 17 ``` [`flows`](https://filetrace.mintlify.site/cli/flows) splits the bytes of a socket by process and remote endpoint. ## Exit codes | Code | Meaning | | - | - | | 0 | Success | | 1 | General error | | 2 | Invalid arguments | | 3 | Permission denied: the agent socket is not accessible to this user | | 4 | No agent is running | | 5 | Unsupported platform or capability | | 6 | The configuration file cannot be read or is invalid | | 9 | Partial results: events were lost in the queried time range | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.