socket

Prototype

int socket(int domain, int type, int protocol);

Returns: int

Arguments

Version history

Examples

#include <sys/socket.h>
#include <netinet/in.h>

int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd < 0) perror("socket");

Notes

macOS implements BSD sockets in xnu's bsd/kern/uipc_socket.c on top of Mach-backed file descriptors. The kernel routes the (domain, type, protocol) triple through pr_usrreqs of the matching protosw, then attaches the resulting socket to a fileproc so it can participate in select/kqueue/poll. Since Big Sur, user-space TCP/UDP for many flows is brokered through the Network Extension framework and the Skywalk data path, but the legacy socket() entry point remains the universal allocator. Sandboxed apps may receive ENOTSUP for AF_INET/AF_INET6 when the network entitlements are missing.

Detection

Endpoint Security has no dedicated event for raw socket() creation. To observe socket lifecycle, attach a NetworkExtension content filter (NEFilterDataProvider) or use the proc_info PROC_PIDFDSOCKETINFO walker against /dev/fdesc. DTrace's syscall::socket:entry probe is reliable on Intel and on Apple Silicon when SIP is disabled.

Related APIs