UNHIDE-TCP(8)

📦
this version · 3 versions
, in arch rolling, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu questing, ubuntu resolute, ubuntu stonking

💅 UNHIDE-TCP — the manual, bestie edition 💅

okay so this is unhide-tcp, section 8 of the System Manager's Manual, and it's literally a forensic girlie whose whole job is catching ports that are sneaking around. buckle up. 🎀

✨ NAME ✨

unhide-tcp — a forensic tool to find hidden TCP/UDP ports 🕵️♀️

✨ SYNOPSIS ✨

unhide-tcp [options]

✨ DESCRIPTION ✨

okay so unhide-tcp is a forensic tool and what it does is it sniffs out TCP/UDP ports that are listening but that /sbin/ss is NOT telling you about (or /bin/netstat if that's your vibe instead). how does it catch them? brute forcing. every. single. TCP/UDP port available. no port escapes. 💀

Note1 🫶 On FreeBSD and OpenBSD, netstat is always used, because iproute2 straight up does not exist on those OSes. and also on FreeBSD, sockstat gets used instead of fuser.
Note2 🫶 If iproute2 is not available on your system, you SHOULD pass -n or -s on the command line. like, should should. do it. 😭

✨ OPTIONS ✨

  • -h, --help — displays help. that's it, that's the whole thing. 👑
  • --brief — don't display warning messages. and ngl, that's already the default behavior, so this one's just here for the drama. 🙈
  • -f, --fuser — displays fuser output (if available) for the hidden port. and on FreeBSD, instead of the fuser command, it shows you the output of the sockstat command for that hidden port. 🌸
  • -l, --lsof — displays lsof output (if available) for the hidden port. iconic. 🔥
  • -n, --netstat — uses /bin/netstat instead of /sbin/ss. heads up though: on systems with a LOT of opened ports, this can slow the test down dramatically. like, dramatically dramatically. 😭
  • -s, --server — uses a super quick scanning strategy. on systems with a lot of opened ports, this is hundreds of times faster than the ss method and ten thousands of times faster than the netstat method. she ate. 💅
  • -o, --log — writes a log file called unhide-tcp-AAAA-MM-DD.log in the current directory. 📝
  • -V, --version — shows the version and exits. periodt. ✨
  • -v, --verbose — be verbose, display the warning message (default: don't display). and bestie, you can repeat this option more than once. stack it. 🫶

🌈 Exit status 🌈

  • 0 — if no hidden port is found 🎀
  • 4 — if one or more hidden TCP port(s) is(are) found 👀
  • 8 — if one or more hidden UDP port(s) is(are) found 👀
  • 12 — if one or more hidden TCP and UDP ports are found 💀

✨ BUGS ✨

found a bug? report those unhide-tcp bugs on the bug tracker on GitHub: https://github.com/YJesus/Unhide/issues 🐛

✨ SEE ALSO ✨

unhide (8). 💜

✨ AUTHOR ✨

this manual page was written by Francois Marier (francois@debian.org) and Patrick Gouin (patrickg.github@free.fr). 🫶

permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 3 or any later version published by the Free Software Foundation.

✨ LICENSE ✨

license GPLv3+: GNU GPL version 3 or later, http://gnu.org/licenses/gpl.html.

this is free software: you are free to change and redistribute it. and there is NO WARRANTY, to the extent permitted by law. no cap. 💅

and that's the whole page, bestie!! this came out of the Administration commands corner of the manual, dated May 2024, and it lives at UNHIDE-TCP(8) in the System Manager's Manual. go catch some sneaky ports. 🦋✨💖
📦 where this page comes from