unhide-tcp8
Forensic tool to find hidden tcp/udp ports
Usage
unhide-tcp [options]
Overview
unhide-tcp is a forensic tool that identifies TCP/UDP ports that are listening but are not listed by /sbin/ss (or alternatively by /bin/netstat) through brute forcing of all TCP/UDP ports available.
Note1 : On FreeBSD ans OpenBSD, netstat is always used as iproute2 doesn't exist on these OS. In addition, on FreeBSD, sockstat is used instead of fuser. Note2 : If iproute2 is not available on the system, option -n or -s SHOULD be given on the command line.
Options
-
-h --help -
Display help
-
--brief -
Don't display warning messages, that's the default behavior.
-
-f --fuser -
Display fuser output (if available) for the hidden port On FreeBSD, instead of fuser command, displays the output of the sockstat command for the hidden port.
-
-l --lsof -
Display lsof output (if available) for the hidden port
-
-n --netstat -
Use /bin/netstat instead of /sbin/ss. On system with many opened ports, this can slow down the test dramatically.
-
-s --server -
Use a very quick strategy of scanning. On system with a lot of opened ports, it is hundreds times faster than ss method and ten thousands times faster than netstat method.
-
-o --log -
Write a log file (unhide-tcp-AAAA-MM-DD.log) in the current directory.
-
-V --version -
Show version and exit
-
-v --verbose -
Be verbose, display warning message (default : don't display). This option may be repeated more than once.
Exit status:
- 0
-
if no hidden port is found,
- 4
-
if one or more hidden TCP port(s) is(are) found,
- 8
-
if one or more hidden UDP port(s) is(are) found,
- 12
-
if one or more hidden TCP and UDP ports are found.
History
- Arch Linux 2026-11-01 to Debian 13 (Trixie): the text shown here
- Debian 12 (Bookworm)
- Debian 11 (Bullseye) to Debian 10 (Buster)
- Debian 9 (Stretch)
- Debian 8 (Jessie)
- Debian 7 (Wheezy)
- Debian 6.0 (Squeeze)
- Debian 5.0 (Lenny)
--brief since Debian 8 (Jessie);
--fuser since Debian 8 (Jessie);
--help since Debian 8 (Jessie);
--log since Debian 8 (Jessie);
--lsof since Debian 8 (Jessie);
--netstat since Debian 8 (Jessie);
--server since Debian 8 (Jessie);
--verbose since Debian 8 (Jessie);
--version since Debian 8 (Jessie);
-V since Debian 8 (Jessie);
-f since Debian 8 (Jessie);
-h since Debian 8 (Jessie);
-l since Debian 8 (Jessie);
-n since Debian 8 (Jessie);
-o since Debian 8 (Jessie);
-s since Debian 8 (Jessie);
-v since Debian 8 (Jessie).