SELECT s.family, protocol, s.local_port, s.remote_port, s.local_address, s.remote_address, p.name, p.path, p.cmdline AS child_cmd, p.cwd, s.pid, s.net_namespace, pp.path AS parent_path, p.parent AS parent_pid, pp.cmdline AS parent_cmd, hash.sha256, CONCAT( MIN(s.remote_port, 32768), ",", protocol, ",", MIN(p.uid, 500), ",", p.name ) AS exception_key FROM process_open_sockets s LEFT JOIN processes p ON s.pid = p.pid LEFT JOIN processes pp ON p.parent = pp.pid LEFT JOIN hash ON p.path = hash.path WHERE protocol > 0 AND s.remote_port > 0 AND s.remote_address NOT IN ("127.0.0.1", "::ffff:127.0.0.1", "::1") AND s.remote_address NOT LIKE "fe80:%" AND s.remote_address NOT LIKE "127.%" AND s.remote_address NOT LIKE "192.168.%" AND s.remote_address NOT LIKE "172.1%" AND s.remote_address NOT LIKE "172.2%" AND s.remote_address NOT LIKE "172.30.%" AND s.remote_address NOT LIKE "172.31.%" AND s.remote_address NOT LIKE "::ffff:172.%" AND s.remote_address NOT LIKE "10.%" AND s.remote_address NOT LIKE "::ffff:10.%" AND s.remote_address NOT LIKE "fc00:%" AND s.state != "LISTEN" -- DNS clients AND NOT ( remote_port = 53 AND protocol IN (6, 17) AND p.name IN ( "1password", "apt", "apt-get", "Brackets", "chainctl", "chrome", "chronyd", "cloud_sql_proxy", "code", "containerd", "controlplane", "crc", "curl", "dig", "dnf", "electron", "firefox", ".firefox-wrappe", "flameshot", "gh", "git-remote-http", "gitsign", "gnome-software", "go", "grafana-server", "grype", "host", "htop", "istioctl", "jcef_helper", "k6", "k9s", "ko", "kolide-pipeline", "launcher", "NetworkManager", "ngrok", "nix", "node", "nscd", "obs", "obs-browser-page", "obs-ffmpeg-mux", "obsidian", "opera", "pacman", "ping", "podman", "prometheus", "rootlessport", "signal-desktop", "slack", "slirp4netns", "snapd", "snap-store", "Socket Process", "spotify", "ssh", "steam", "steamwebhelper", "syncthing", "systemd-resolve", "tailscaled", ".tailscaled-wra", "terraform", "terraform-provi", "tkn", "traceroute", "vcluster", "wget", "whois", "xmobar", "yay", "zoom" ) ) -- General exceptions AND NOT exception_key IN ( "123,17,500,chronyd", "22,6,,", -- shortlived SSH (git push) "123,17,,", "22,6,500,ssh", "22067,6,500,syncthing", "443,6,500,CrBrowserMain", "443,6,500,CrUtilityMain", "443,6,500,wineserver", "27024,6,500,steam", "3100,6,500,firefox", "3100,6,500,k6", "3307,6,500,cloud_sql_proxy", "4070,6,500,spotify", "443,17,500,chrome", "443,17,500,electron", "443,17,500,jcef_helper", "443,17,500,slack", "443,17,500,spotify", "443,6,0,.tailscaled-wra", "443,6,0,dnf", "443,6,0,dockerd", "443,6,500,influxd", "443,6,0,influxd", "443,6,0,launcher", "443,6,0,pacman", "443,6,0,snapd", "443,6,0,tailscaled", "443,6,500,java", "443,6,472,grafana-server", "443,6,500,.firefox-wrappe", "443,6,500,1password", "443,6,500,authentik-proxy", "443,6,500,WebKitNetworkPr", "443,6,500,Brackets", "443,6,500,celery", "443,6,500,chainctl", "443,6,500,chrome", "443,6,500,cloud_sql_proxy", "443,6,500,code", "443,6,500,containerd", "443,6,500,controlplane", "443,6,500,cosign", "443,6,500,crane", "443,6,500,gvfsd-http", "443,6,500,crc", "443,6,500,curl", "443,6,500,Discord", "443,6,500,electron", "443,6,500,firefox", "443,6,500,flameshot", "443,6,500,gh", "443,6,500,git-remote-http", "443,6,500,gitsign", "443,6,500,gnome-shell", "443,6,500,gnome-software", "443,6,500,go", "443,6,500,grafana-server", "443,6,500,grype", "443,6,500,gunicorn", "443,6,500,WebKitNetworkPr", "443,6,500,htop", "443,6,500,istioctl", "443,6,500,k6", "443,6,500,k9s", "443,6,500,ko", "443,6,500,kolide-pipeline", "80,6,500,spotify", "443,6,500,kubectl", "443,6,500,ngrok", "443,6,500,nix", "443,6,0,containerd", "443,6,500,node", "443,6,500,obs-browser-page", "443,6,500,obs-ffmpeg-mux", "443,6,500,obs", "443,6,500,obsidian", "443,6,500,podman", "443,6,500,jetbrains-toolb", "443,6,500,signal-desktop", "443,6,500,slack", "443,6,500,slirp4netns", "443,6,500,snap-store", "443,6,500,Socket Process", "443,6,500,spotify", "443,6,500,steamwebhelper", "443,6,0,dirmngr", "443,6,500,terraform-provi", "443,6,500,terraform", "443,6,500,tkn", "443,6,500,vcluster", "443,6,500,wget", "443,6,500,xmobar", "443,6,500,yay", "443,6,500,zoom", "5228,6,500,chrome", "6000,6,500,ssh", "80,6,0,.tailscaled-wra", "80,6,0,dnf", "80,6,0,NetworkManager", "80,6,0,pacman", "80,6,0,tailscaled", "80,6,500,.firefox-wrappe", "80,6,500,curl", "80,6,500,firefox", "80,6,500,steam", "80,6,500,steamwebhelper", "80,6,500,syncthing", "8006,6,500,chrome", "8801,17,500,zoom", "9090,6,500,firefox", "9090,6,500,k6", "9090,6,500,prometheus", "9090,6,500,rootlessport" ) -- These programs would normally never make an outgoing connection, but thanks to Nix, it can happen. AND NOT ( remote_address LIKE ("151.101.%") AND remote_port = 443 AND protocol = 6 AND ( parent_path LIKE "%/bash" OR parent_path LIKE "%/zsh" OR p.path LIKE "/nix/store/%/bash" ) ) -- Other more complicated situations AND NOT ( p.name = "rootlessport" AND remote_port > 1024 ) AND NOT ( p.name = "syncthing" AND ( remote_port IN (53, 80, 88, 110, 443, 587, 993, 3306, 7451) OR remote_port > 8000 ) ) AND NOT ( p.name IN ( "chrome", "Google Chrome Helper", "Brave Browser Helper", "Chromium Helper", "Opera Helper" ) AND remote_port IN ( 53, 3100, 443, 80, 8006, 9000, 5004, 8009, 8080, 8888, 8443, 5228, 32211, 53, 10001, 3478, 19305, 19306, 19307, 19308, 19309 ) ) AND NOT ( p.name IN ("thunderbird") AND remote_port IN (53, 143, 443, 587, 465, 585, 993) ) AND NOT ( p.name IN ("spotify", "Spotify Helper", "Spotify") AND remote_port IN (53, 443, 8009, 4070, 32211) ) AND NOT ( remote_port IN (443, 53) AND p.name LIKE "terraform-provider-%" ) AND NOT ( remote_port iN (443, 53) AND p.name LIKE "kubectl.%" ) AND NOT ( p.cmdline LIKE "%google-cloud-sdk/lib/gcloud.py%" AND remote_port IN (80, 53, 443) ) GROUP BY p.cmdline