Difference between revisions of "Watching socket activity"

Revision as of 12:02, 10 March 2009

A shell script (watch-sockets):

#!/bin/sh
TMPFILE_LAST=`mktemp /tmp/temp.XXXXXX`
TMPFILE_CURRENT=`mktemp /tmp/temp.XXXXXX`
TMPFILE_DIFF=`mktemp /tmp/temp.XXXXXX`
lsof -n -i -P | grep COMMAND
lsof -n -i -P | grep -v COMMAND > $TMPFILE_LAST
cp $TMPFILE_LAST socket.log
while [ 1 ]
do
        lsof -n -i -P | grep -v COMMAND > $TMPFILE_CURRENT
        diff -b $TMPFILE_LAST $TMPFILE_CURRENT | grep "  " > $TMPFILE_DIFF
        if [ -s $TMPFILE_DIFF ]
        then
                lsof -n -i -P | grep -v COMMAND > $TMPFILE_LAST
                echo `date +%k:%M:%S` >> socket.log
                cat $TMPFILE_DIFF >> socket.log
                date +%k:%M:%S
                cat $TMPFILE_DIFF
        fi
        usleep 100000
done

Will log the initial sockets, and then any changes over time; also show the changes over time on stdout.

Here is another solution using netstat rather than lsof.