BSD syscall#30
svc · unix #30
accept
Dequeues the first completed connection from a listening socket and returns a new descriptor.
Prototype
int accept(int s, caddr_t name, socklen_t *anamelen);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| s | int | - | |
| name | caddr_t | - | |
| anamelen | socklen_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 30 |
| xnu-1486.2.11 | — | 30 |
| xnu-1504.15.3 | — | 30 |
| xnu-1504.3.12 | — | 30 |
| xnu-1504.7.4 | — | 30 |
| xnu-1504.9.17 | — | 30 |
| xnu-1504.9.26 | — | 30 |
| xnu-1504.9.37 | — | 30 |
Notes
macOS supports the classic blocking accept and the Linux-style accept4-like behavior via fcntl on the returned fd. Connections that pass NECP policy but are blocked by a content filter never appear here — the filter rejects them before they reach so_comp. For high-throughput servers, kqueue with EVFILT_READ on the listening socket coalesces accept-ready notifications.
Detection
No direct ES coverage. Inbound flows surface to NEFilterDataProvider's handleNewFlow with an NEFilterSocketFlow whose direction is .inbound. proc_pidfdinfo on the accepted fd yields the remote sockaddr for forensic logging.
Related APIs
socketbindlistengetpeernameshutdown