Show active TCP connections
Read-only
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Lists currently established TCP connections and the processes that own them, useful for seeing what a machine is talking to right now.
networkconnectionstcpinspect
Commands
List established TCP connections with their owning processes
lsof -nP -iTCP -sTCP:ESTABLISHEDVerification
lsof -nP -iTCP -sTCP:ESTABLISHEDA table of established connections; an empty result means nothing is currently connected.
Undo
Not undoable
This recipe only reads connection state and changes nothing.
Pitfalls
- Connections owned by other users are hidden without elevated privileges.
- The list is a snapshot; short-lived connections may appear and disappear between runs.
- The verification command uses macOS syntax; on Linux use "ss -tnp state established" and on Windows "Get-NetTCPConnection -State Established".