MIZPAH
LOCAL AUDIT
Read the active socket table.
No port-by-port scan. Mizpah asks the operating system what is bound right now.
KERNEL → SNAPSHOT SYSTEM READY WINDOWS / LINUX LOCAL ONLY
Every open port
has an owner.
Mizpah connects the dots between processes, ports, and network exposure—so you can see what is listening and why.
LIVE PORT MAP
READING HOST
ACTIVE351
LISTENERS264
EXPOSED112
PROCESSPORTREACH
nodePID 1840
ollamaPID 9024
systemPID 4
3000
11434
445
LOCALHOST
LOCALHOST
ALL INTERFACES
COLLECTOR / WINDOWS_IPHELPERCAPTURE / 08:34:49
01 INSPECT THE BOUNDARY
One address changes
the whole story.
A development service can be healthy and still be reachable farther than you intended. Change the binding below and watch the route redraw.
A / PROCESS
N
node.exeC:\Program Files\nodejs\node.exe
- PID
- 1840
- STATE
- LISTENING
TCP ROUTE
PORT3000
B / INTERFACE
LOOPBACK
Reachable only from this machine.
EXPECTED BOUNDARY02 THE OPERATOR LOOP
Trace it.
Read it.
Resolve it.
Four steps turn a noisy socket table into a decision you can account for.
Connect the port to its process.
PID, process name, executable path, state, address, and binding scope.
SOCKET → OWNERExpose what changed.
A known-good baseline makes new and removed listeners stand apart from routine churn.
NOW ≠ BASELINEChange the host deliberately.
Preview the target, confirm the action, then retain the result in the timeline.
PREVIEW → CONFIRM03 THE LOCAL CONSOLE
The answer is already
on your machine.
A focused operations surface for the listeners that matter, the processes behind them, and the changes since your baseline.
CURRENT POSTURE
4 listeners need review.
Two are new since baseline. Two are bound to all interfaces.
ENDPOINTS351+7 since capture
LISTENERS26475% of endpoints
EXPOSED112all interfaces
ATTRIBUTED97%process ownership
RANKED FINDINGSSCOPE / LISTENERS
01
TCP / 22SSH remote shell
BOUND TO0.0.0.0 + ::
CRITICAL02
TCP / 3000node
BOUND TO0.0.0.0
HIGH03
TCP / 11434ollama
BOUND TO0.0.0.0
HIGH04 WHO NEEDS THE ANSWER
“Which thing opened this port?”
See the APIs, databases, containers, AI tools, and development servers behind the number.
INSPECT MY MACHINE ↗PID 1840→ TCP 3000
“What changed on this host?”
Capture a known-good state, identify listener drift, and preserve an accountable timeline.
GET THE CONSOLE ↗BASELINE≠NOW+04
05 THE TRUST BOUNDARY
Local by design.
Legible by default.
Mizpah observes locally, explains locally, and binds its console to loopback unless you deliberately change that boundary.
01OS SOCKET TABLESWindows / Linux
→02NATIVE COLLECTORDependency-free Go
→03LOCAL API127.0.0.1
→04YOUR CONSOLENo cloud analysis
06 START LOCAL
See what is
listening.
No account. No cloud setup. Download the local audit console and get an answer in minutes.