From Electron Cloud
A shell script (watch-sockets):
#!/bin/sh TMPFILE_LAST=`mktemp /tmp/temp.XXXXXX` TMPFILE_CURRENT=`mktemp /tmp/temp.XXXXXX` TMPFILE_DIFF=`mktemp /tmp/temp.XXXXXX` lsof -n -i -P | grep COMMAND lsof -n -i -P | grep -v COMMAND > $TMPFILE_LAST cp $TMPFILE_LAST socket.log while [ 1 ] do lsof -n -i -P | grep -v COMMAND > $TMPFILE_CURRENT diff -b $TMPFILE_LAST $TMPFILE_CURRENT | grep " " > $TMPFILE_DIFF if [ -s $TMPFILE_DIFF ] then lsof -n -i -P | grep -v COMMAND > $TMPFILE_LAST echo `date +%k:%M:%S` >> socket.log cat $TMPFILE_DIFF >> socket.log date +%k:%M:%S cat $TMPFILE_DIFF fi usleep 100000 done
Will log the initial sockets, and then any changes over time; also show the changes over time on stdout.
Here is another solution using netstat rather than lsof.