BSD syscall#106
svc · unix #106
listen
Marks a connection-oriented socket as passive, ready to accept incoming connections.
Prototype
int listen(int s, int backlog);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| s | int | - | |
| backlog | int | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 106 |
| xnu-1486.2.11 | — | 106 |
| xnu-1504.15.3 | — | 106 |
| xnu-1504.3.12 | — | 106 |
| xnu-1504.7.4 | — | 106 |
| xnu-1504.9.17 | — | 106 |
| xnu-1504.9.26 | — | 106 |
| xnu-1504.9.37 | — | 106 |
Notes
On macOS the backlog is capped by kern.ipc.somaxconn (default 128) and the per-socket so_qlimit. The kernel pre-creates an incomplete-connection queue and a completed-connection queue inside the inpcb. Listening sockets on TCP ports below 1024 still require elevated privileges, and the App Sandbox 'network.server' entitlement is mandatory for sandboxed daemons.
Detection
No ES event. Use lsof -nP -iTCP -sTCP:LISTEN or netstat -anvp tcp, and correlate against launchd's known service sockets. NEFilterDataProvider sees accepted flows but not the listen state itself.
Related APIs
socketbindacceptsetsockoptshutdown