Tag Info

New answers tagged

4

On Linux at least, lsof can't tell you which end initiated the connection as it gets the list from /proc/net/tcp where that information is not available. The first address always refers to the local endpoint. Recent versions of the ss utility (which use a different kernel API to retrieve connection information), with -e, will give you direction but ...


4

I think the clue is in the port numbers, take these two entries smtpd 12950 postfix 9u IPv4 35762406 0t0 TCP hostname:smtp->spe.cif.ic.IP:55277 (ESTABLISHED) smtp 13007 postfix 13u IPv4 35762309 0t0 TCP hostname:34434->fake.VVVVV.fr:smtp (ESTABLISHED) smtpd has received a connection on port smtp(25) from a high port number, ...


0

Using the basic grep, tr, cut : netstat -4tln | grep LISTEN | tr -s " " ":" | cut -d ":" -f5 | sort -n


0

With sed: sudo netstat -4tln | sed '1d;2d;s/[^:]*:\([0-9]\+\).*/\1/' | sort -n


0

this is better: sudo netstat -4tlpen |sed -n '3,$p'|awk -F':' '{print $2}'|cut -f1 -d' '|sort -n|uniq



Top 50 recent answers are included