OeXYZ

open source · windows & linux

Know what listens. Know what is exposed.

SocketScope is a local, read-only endpoint inspector. It connects TCP and UDP endpoints with process, service, container, interface and firewall evidence without presenting local indicators as proof of Internet reachability.

v1.0.0C#

View on GitHub Download release
socketscope · listeners
SocketScope listener view with local TCP and UDP endpoints and associated evidence
Listener inventory · controlled local fixture data

purpose

An endpoint is more than a port number.

SocketScope shows which process listens on which address, which service or container may be behind it and which local firewall rules are relevant candidates.

The tool is deliberately read-only: it does not scan other systems, does not change any firewall and does not claim that local evidence alone proves actual reachability from the Internet.

  • .NET 10
  • Windows
  • Linux
  • x64 + ARM64
  • MIT

connections

Local states, explained in context.

socketscope · connections
SocketScope connection view with local endpoints, process attribution and status information
Live connections · process and binding attribution · local evidence

features

Analyze read-only. Back it up cleanly.

[01]

TCP & UDP inventory

Live view for IPv4 and IPv6 with listeners, active connections, state, and local and remote endpoints.

[02]

Owner Attribution

Best-effort attribution to process, PID, path, Windows service, systemd unit, cgroup or container.

[03]

Binding classification

Loopback, wildcard and specific interfaces are shown separately so that binding scope and context stay clear.

[04]

Firewall evidence

Matching local rules are shown as candidates, as traceable evidence and not as a security guarantee.

[05]

Snapshots & comparison

States can be captured and compared locally to spot new, removed or changed endpoints faster.

[06]

Share-safe Reports

Full or sanitized HTML and JSON reports support diagnosis and sharing without unnecessary local details.

reports

Built for analysis. Sanitized for sharing.

Full reports keep the local diagnostic context. Share-safe exports reduce sensitive host details before results are passed on.

socketscope · reports
SocketScope report export with full and sanitized share-safe output
HTML and JSON reports · full and share-safe
socketscope · responsive
Compact responsive view of SocketScope
Responsive interface · compact view

operating model

Local. Read-only. No account.

Platforms
Windows · Linux
Architectures
x64 · ARM64
Permissions
Standard user · no service
Data
Local · no telemetry
Tests
216 automated tests
License
MIT

Local evidence is not an external reachability test.

SocketScope shows what a machine can observe locally. NAT, upstream firewalls, routers, provider filtering and other network paths are outside that evidence. Therefore, “reachable from the Internet” remains explicitly unconfirmed until a separate external test has taken place.

roadmap

The analysis is done. Changes stay controlled.

The roadmap follows the public repository. Planned features are not yet part of the current release.

  1. Local endpoint inspector

    Windows and Linux inventory, attribution, binding and firewall evidence, snapshots, comparisons and sanitized reports.

  2. Deeper network evidence

    Stronger container and NAT attribution, optional external checks, remote hosts, notifications and native packages.

  3. Privileged actions

    Process, service, firewall or container changes come into question only with their own threat model, preview, explanation and explicit confirmation.

socketscope · open source

$ git clone https://github.com/Oexyz/SocketScope

Source code, documentation, platform notes, tests and releases are publicly available on GitHub.

GitHub repository