facebook/osquery — pull request #287 by astanway (2014-10-30 01:13:55+00:00)
Title: Socket_inode and port_inode tables to map PIDs->ports via netlink inet_diag

Currently no way on Linux to map processes listening on ports to their PIDs, ala listening_ports for Darwin. This enables that.

Example query:
```
SELECT port.local_port,
port.remote_port,
port.local_ip,
port.remote_ip,
socket.pid,
process.name,
FROM socket_inode AS socket
JOIN port_inode AS port
ON socket.inode = port.inode
INNER JOIN processes AS process
ON socket.pid = process.pid;
```

Tested on Ubuntu 14.04