Parse:...darwin(3pm)
💖 Parse::Netstat::darwin 💖
okay so bestie, welcome to Parse::Netstat::darwin — she lives in the Parse-Netstat Perl distribution and her whole entire job is parsing what your Mac spits out when you run the netstat command. lowkey essential, highkey underrated. 🍓
🌸 NAME 🌸
Parse::Netstat::darwin — parse the output of the Mac OS X netstat command. that's the vibe. that's the whole thing. ✨
👑 VERSION 👑
This doc describes version 0.150 of Parse::Netstat::darwin, which ships inside the Perl distribution Parse-Netstat, and it was released on 2022-12-04. vintage but still serving. 💅
🎀 SYNOPSIS 🎀
So the way you use her is like this, bestie:
use Parse::Netstat qw(parse_netstat);
my $res = parse_netstat(output=>join("", `netstat -an`), flavor=>"darwin");and here's what a sample netstat -an output looks like, so you know exactly the kind of chaos we're working with:
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 10.8.0.6.54433 1.2.3.4.443 ESTABLISHED
tcp46 0 0 *.80 *.* LISTEN
tcp6 0 0 *.88 *.* LISTEN
udp4 0 0 *.* *.*
udp6 0 0 *.52919 *.*
udp46 0 0 *.* *.*
Active Multipath Internet connections
Proto/ID Flags Local Address Foreign Address (state)
Active LOCAL (UNIX) domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
4f1eb4c58685585f stream 0 0 0 4f1eb4c5868572ef 0 0 /var/run/mDNSResponder
4f1eb4c5868572ef stream 0 0 0 4f1eb4c58685585f 0 0
4f1eb4c578f0c92f stream 0 0 0 4f1eb4c578f0c2ef 0 0
4f1eb4c58bd4e227 stream 0 0 4f1eb4c5891011b7 0 0 0 /var/run/vmnat.40388
Registered kernel control modules
id flags pcbcount rcvbuf sndbuf name
1 9 0 131072 131072 com.apple.flow-divert
2 1 1 16384 2048 com.apple.nke.sockwall
3 9 0 524288 524288 com.apple.content-filter
4 9 0 8192 2048 com.apple.packet-mangler
5 1 3 65536 65536 com.apple.net.necp_control
6 1 10 65536 65536 com.apple.net.netagent
7 9 5 524288 524288 com.apple.net.utun_control
8 1 0 65536 65536 com.apple.net.ipsec_control
9 0 39 8192 2048 com.apple.netsrc
a 18 4 8192 2048 com.apple.network.statistics
b 5 0 8192 2048 com.apple.network.tcp_ccdebug
c 1 1 8192 2048 com.apple.network.advisory
d 1 1 8192 2048 com.vmware.kext.vmci
e 1 9 229376 229376 com.vmware.kext.vmnet
f 1 168 8192 2048 com.vmware.kext.vmx86
Active kernel event sockets
Proto Recv-Q Send-Q vendor class subcla
kevt 0 0 1 1 11
kevt 0 0 1 1 7
kevt 0 0 1 1 1
kevt 0 0 1 4 0
kevt 0 0 1 6 1
kevt 0 0 1 6 1
kevt 0 0 1 1 2
kevt 0 0 1 6 1
kevt 0 0 1 6 1
kevt 0 0 1 1 10
kevt 0 0 1001 5 11
kevt 0 0 1 6 1
kevt 0 0 1 6 1
kevt 0 0 1 6 1
kevt 0 0 1 6 1
kevt 0 0 1 6 1
kevt 0 0 1 6 1
kevt 0 0 1 1 2
kevt 0 0 1 1 2
kevt 0 0 1 6 1
kevt 0 0 1 1 0
Active kernel control sockets
Proto Recv-Q Send-Q unit id name
kctl 0 0 1 2 com.apple.nke.sockwall
kctl 0 0 1 5 com.apple.net.necp_control
kctl 0 0 2 5 com.apple.net.necp_control
kctl 0 0 3 5 com.apple.net.necp_control
kctl 0 0 1 6 com.apple.net.netagent
kctl 0 0 2 6 com.apple.net.netagent
kctl 0 0 3 6 com.apple.net.netagent
kctl 0 0 4 6 com.apple.net.netagent
kctl 0 0 5 6 com.apple.net.netagent
kctl 0 0 6 6 com.apple.net.netagent
kctl 0 0 7 6 com.apple.net.netagent
kctl 0 0 8 6 com.apple.net.netagent
kctl 0 0 10 6 com.apple.net.netagent
kctl 0 0 11 6 com.apple.net.netagent
kctl 0 0 1 7 com.apple.net.utun_control
kctl 0 0 2 7 com.apple.net.utun_control
kctl 0 0 3 7 com.apple.net.utun_control
kctl 0 0 4 7 com.apple.net.utun_control
kctl 0 0 5 7 com.apple.net.utun_control
kctl 0 0 1 9 com.apple.netsrc
kctl 0 0 2 9 com.apple.netsrc
kctl 0 0 3 9 com.apple.netsrc
kctl 0 0 4 9 com.apple.netsrc
kctl 0 0 5 9 com.apple.netsrc
kctl 0 0 6 9 com.apple.netsrc
kctl 0 0 7 9 com.apple.netsrc
kctl 0 0 9 9 com.apple.netsrc
kctl 0 0 10 9 com.apple.netsrc
kctl 0 0 11 9 com.apple.netsrc
kctl 0 0 12 9 com.apple.netsrc
kctl 0 0 13 9 com.apple.netsrc
kctl 0 0 14 9 com.apple.netsrc
kctl 0 0 15 9 com.apple.netsrc
kctl 0 0 16 9 com.apple.netsrc
kctl 0 0 17 9 com.apple.netsrc
kctl 0 0 18 9 com.apple.netsrc
kctl 0 0 19 9 com.apple.netsrc
kctl 0 0 20 9 com.apple.netsrc
kctl 0 0 21 9 com.apple.netsrc
kctl 0 0 22 9 com.apple.netsrc
kctl 0 0 23 9 com.apple.netsrc
kctl 0 0 24 9 com.apple.netsrc
kctl 0 0 25 9 com.apple.netsrc
kctl 0 0 26 9 com.apple.netsrc
kctl 0 0 27 9 com.apple.netsrc
kctl 0 0 28 9 com.apple.netsrc
kctl 0 0 29 9 com.apple.netsrc
kctl 0 0 30 9 com.apple.netsrc
kctl 0 0 31 9 com.apple.netsrc
kctl 0 0 32 9 com.apple.netsrc
kctl 0 0 33 9 com.apple.netsrc
kctl 0 0 34 9 com.apple.netsrc
kctl 0 0 35 9 com.apple.netsrc
kctl 0 0 36 9 com.apple.netsrc
kctl 0 0 38 9 com.apple.netsrc
kctl 0 0 41 9 com.apple.netsrc
kctl 0 0 43 9 com.apple.netsrc
kctl 0 0 44 9 com.apple.netsrc
kctl 0 0 1 10 com.apple.network.statistics
kctl 0 0 2 10 com.apple.network.statistics
kctl 0 0 3 10 com.apple.network.statistics
kctl 0 0 4 10 com.apple.network.statistics
kctl 0 0 1 12 com.apple.network.advisory
kctl 0 0 1 13 com.vmware.kext.vmci
kctl 0 0 1 14 com.vmware.kext.vmnet
kctl 0 0 2 14 com.vmware.kext.vmnet
kctl 0 0 3 14 com.vmware.kext.vmnet
kctl 0 0 4 14 com.vmware.kext.vmnet
kctl 0 0 5 14 com.vmware.kext.vmnet
kctl 0 0 6 14 com.vmware.kext.vmnet
kctl 0 0 7 14 com.vmware.kext.vmnet
kctl 0 0 8 14 com.vmware.kext.vmnet
kctl 0 0 9 14 com.vmware.kext.vmnet
kctl 0 0 1 15 com.vmware.kext.vmx86and then, sample result… 🦋
[
200,
"OK",
{
active_conns => [
{
foreign_host => "1.2.3.4",
foreign_port => 443,
local_host => "10.8.0.6",
local_port => 54433,
proto => "tcp4",
recvq => 0,
sendq => 0,
state => "ESTABLISHED",
},
{
foreign_host => "*",
foreign_port => "*",
local_host => "*",
local_port => 80,
proto => "tcp46",
recvq => 0,
sendq => 0,
state => "LISTEN",
},
{
foreign_host => "*",
foreign_port => "*",
local_host => "*",
local_port => 88,
proto => "tcp6",
recvq => 0,
sendq => 0,
state => "LISTEN",
},
{
foreign_host => "*",
foreign_port => "*",
local_host => "*",
local_port => "*",
proto => "udp4",
recvq => 0,
sendq => 0,
},
{
foreign_host => "*",
foreign_port => "*",
local_host => "*",
local_port => 52919,
proto => "udp6",
recvq => 0,
sendq => 0,
},
{
foreign_host => "*",
foreign_port => "*",
local_host => "*",
local_port => "*",
proto => "udp46",
recvq => 0,
sendq => 0,
},
{},
{},
{
addr => "/var/run/mDNSResponder",
address => "4f1eb4c58685585f",
conn => "4f1eb4c5868572ef",
inode => 0,
nextref => 0,
proto => "unix",
recvq => 0,
refs => 0,
sendq => 0,
type => "stream",
},
{
address => "4f1eb4c5868572ef",
conn => "4f1eb4c58685585f",
inode => 0,
nextref => 0,
proto => "unix",
recvq => 0,
refs => 0,
sendq => 0,
type => "stream",
},
{
address => "4f1eb4c578f0c92f",
conn => "4f1eb4c578f0c2ef",
inode => 0,
nextref => 0,
proto => "unix",
recvq => 0,
refs => 0,
sendq => 0,
type => "stream",
},
{
addr => "/var/run/vmnat.40388",
address => "4f1eb4c58bd4e227",
conn => 0,
inode => "4f1eb4c5891011b7",
nextref => 0,
proto => "unix",
recvq => 0,
refs => 0,
sendq => 0,
type => "stream",
},
{},
],
},
]🦋 FUNCTIONS 🦋
✨ parse_netstat ✨
Usage, bestie 👇
parse_netstat(%args) -> [$status_code, $reason, $payload, \%result_meta]Parse the output of Mac OS X netstat command. 💖
So here's the tea: netstat can be called with -n (which shows you the raw IP addresses and port numbers instead of hostnames or port names) or without it. It can also be called with the -a option (which shows all listening and non-listening sockets) or without. Either way, this function handles it. 🫶
Heads up, bestie: this function is not exported by default, but it is exportable. So you gotta ask for it, no cap.
🎀 Arguments ('*' denotes required arguments): 🎀
output*=> str — the output of thenetstatcommand. That's the whole vibe, it's required, periodt.tcp=> bool (default:1) — whether to parse TCP (and TCP6) connections. Yes queen, on by default.udp=> bool (default:1) — whether to parse UDP (and UDP6) connections. Also on by default, we love to see it.unix=> bool (default:1) — whether to parse Unix socket connections. Yep, default1too. 💅
🌸 What you get back 🌸
Returns an enveloped result (an array, obvs).
- First element (
$status_code) is an integer holding an HTTP-like status code (so200means OK,4xxis a caller error,5xxis a function error). It's giving very much HTTP energy. - Second element (
$reason) is a string with the error message, or something like"OK"when the status is200. 💖 - Third element (
$payload) is the actual result — but usually it's not even there when the enveloped result is an error response ($status_codeis not2xx). Like, it ghosted you. 😭 - Fourth element (
%result_meta) is called result metadata and it's optional — a hash that carries extra info, much like how HTTP response headers give you additional metadata. Iconic, honestly.
Return value: (any)
🌈 HOMEPAGE 🌈
Please visit the project's homepage at <https://metacpan.org/release/Parse-Netstat>. Go give it a follow bestie, it deserves it. 👑
🧚 SOURCE 🧚
Source repository is at <https://github.com/perlancar/perl-Parse-Netstat>. Yes, we're on GitHub, come thru. ⭐
💜 AUTHOR 💜
perlancar <perlancar@cpan.org> — the main character, fr fr. 🎀
🌸 CONTRIBUTING 🌸
Wanna help out? Obsessed. To contribute, you can send patches by email/via RT, or send pull requests on GitHub. Pick your fighter. 🫶
Most of the time, you don't need to build the distribution yourself. You can simply modify the code, then test via:
% prove -lAnd if you do wanna build the distribution (like, say, to try to install it locally on your system), you can install Dist::Zilla, Dist::Zilla::PluginBundle::Author::PERLANCAR, Pod::Weaver::PluginBundle::Author::PERLANCAR, and sometimes one or two other Dist::Zilla- and/or Pod::Weaver plugins. Any additional steps required beyond that are considered a bug and can be reported to me. No gatekeeping here. 💅
👑 COPYRIGHT AND LICENSE 👑
This software is copyright (c) 2022, 2017, 2015, 2014, 2012, 2011 by perlancar <perlancar@cpan.org>. A whole legacy, honestly. 💖
This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. Slay. ✨
💀 BUGS 💀
Please report any bugs or feature requests on the bugtracker website <https://rt.cpan.org/Public/Dist/Display.html?Name=Parse-Netstat>. Don't be shy, bestie.
When submitting a bug or request, please include a test-file or a patch to an existing test-file that illustrates the bug or desired feature. Receipts required, no cap. 🧾
and that's the whole page, bestie! 🎉
Cute little sign-off time: this page came to you from perl v5.36.0, dated 2023-01-15, and it's the Parse:...darwin(3pm) page — go forth and parse those connections, you absolute icon. 💅💖🦋
📦 where this page comes from
- debian bookworm: libparse-netstat-perl 0.150-1 · Artistic-1.0-Perl OR GPL-1.0-or-later
- debian trixie: libparse-netstat-perl 0.150-1 · Artistic-1.0-Perl OR GPL-1.0-or-later
- ubuntu noble: libparse-netstat-perl 0.150-1 · Artistic-1.0-Perl OR GPL-1.0-or-later
- ubuntu resolute: libparse-netstat-perl 0.150-1 · Artistic-1.0-Perl OR GPL-1.0-or-later
- ubuntu stonking: libparse-netstat-perl 0.150-1 · Artistic-1.0-Perl OR GPL-1.0-or-later
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms