9

Is there a command similar to netstat -np but grouped by state and PID?

I'd like to know the current count of server connections in a particular state grouped by Programs.

similar to,

102 squid ESTABLISHED
32 httpd ESTABLISHED

I use RHEL5.

11

You can use sort to reorganize the output of netstat in any format you like.

$ netstat -anpt 2>&1 | tail -n +5 | sort -k7,7 -k 6,6

This will sort the output using the 7th column first (the process name/PID) followed by the state (ESTABLISHED, LISTEN, etc.).

NOTE: The first part of the command, netstat -anpt 2>&1 | tail -n +5 .. will direct all the output that may occur on STDOUT to STDIN as well and then chop off the first 5 lines which are boilerplate output from netstat which we are uninterested in.

Example

$ netstat -anpt 2>&1 | tail -n +5 | sort -k7,7 -k 6,6
tcp        0      0 192.168.1.20:49309      192.168.1.103:631       ESTABLISHED 2077/gnome-settings 
tcp        0      0 192.168.1.20:38393      204.62.14.135:443       ESTABLISHED 2260/mono           
tcp        0      0 192.168.1.20:39738      74.125.192.125:5222     ESTABLISHED 2264/pidgin         
tcp        0      0 192.168.1.20:40097      87.117.201.130:6667     ESTABLISHED 2264/pidgin         
tcp        0      0 192.168.1.20:53920      217.168.150.38:6667     ESTABLISHED 2264/pidgin         
...
tcp        1      0 192.168.1.20:50135      190.93.247.58:80        CLOSE_WAIT  24714/google-chrome 
tcp        1      0 192.168.1.20:44420      192.168.1.103:631       CLOSE_WAIT  24714/google-chrome 
tcp        0      0 192.168.1.20:36892      74.125.201.188:5228     ESTABLISHED 24714/google-chrome 
tcp        0      0 192.168.1.20:43778      74.125.192.125:5222     ESTABLISHED 24714/google-chrome 
tcp        0      0 192.168.1.20:33749      198.252.206.140:80      ESTABLISHED 24714/google-chrome 
...

You can use a similar approach to get the counts using various tools such as wc or uniq -c.

Changing the output

If you'd really like to get the output of netstat looking like this:

102 squid ESTABLISHED
32 httpd ESTABLISHED

You can do some further slicing and dicing using awk & sed. This can be made more compact, but should get you started and does the job.

$ netstat -anpt 2>&1 | tail -n +5 | awk '{print $7,$6}' | sort -k1,1 -k3,3 \
    | sed 's#/# #' | column -t
2264   pidgin          ESTABLISHED
2264   pidgin          ESTABLISHED
24714  google-chrome   CLOSE_WAIT
24714  google-chrome   CLOSE_WAIT
24714  google-chrome   ESTABLISHED
24714  google-chrome   ESTABLISHED
...
24714  google-chrome   ESTABLISHED
26358  ssh             ESTABLISHED
26358  ssh             ESTABLISHED
26358  ssh             ESTABLISHED
26358  ssh             LISTEN
26358  ssh             LISTEN
26358  ssh             LISTEN

NOTE: column -t simply aligns all the output in nice columns.

Counting the connections

Finally to do what you want in terms of tallying the occurrences:

$ netstat -anpt 2>&1 | tail -n +5 | awk '{print $7,$6}' | sort -k1,1 -k3,3 \
    | sed 's#/# #' | column -t | uniq -c
  6 -      LISTEN
  8 -      TIME_WAIT
  1 2077   gnome-settings  ESTABLISHED
  1 2260   mono            ESTABLISHED
 10 2264   pidgin          ESTABLISHED
  2 24714  google-chrome   CLOSE_WAIT
 27 24714  google-chrome   ESTABLISHED
  3 26358  ssh             ESTABLISHED
  4 26358  ssh             LISTEN
  1 26359  ssh             ESTABLISHED
  4 3042   thunderbird     ESTABLISHED
  1 32472  monodevelop     ESTABLISHED
  2 32472  monodevelop     LISTEN
  1 32533  mono            ESTABLISHED
  1 32533  mono            LISTEN
  1 3284   monodevelop     LISTEN
  1 3365   mono            LISTEN
  1 4528   mono            LISTEN
  1 8416   dropbox         ESTABLISHED
  1 8416   dropbox         LISTEN

The first column represents the counts.

  • Thank you for such a detailed answer - I'll vote up when I have 15 rep – Kingo Jun 2 '14 at 3:47
5

from wikipedia

On Linux, netstat (part of "net-tools") is deprecated, ss (part of iproute2) should be used instead.

The net-tools package has not seen a Linux release in more than a decade. That's a long time to go without an update for a program suite designed to manage and monitor an ever-evolving kernel's communications interfaces - especially when you're talking about the kernel that practically runs the internet.

Thankfully though, there is the actively maintained iproute2 package - which includes the ss utility.

With ss you can do the thing you ask for like:

ss -np state ESTABLISHED

from man ss:

#USAGE EXAMPLES
   ss -t -a
#          Display all TCP sockets.
#
   ss -t -a -Z
#          Display all TCP sockets with process SELinux
#          security contexts.
#
   ss -u -a
#          Display all UDP sockets.
#
   ss -o state established '( dport = :ssh or sport  =   :ssh )'
#          Display all established ssh connections.
#
   ss -x src /tmp/.X11-unix/*
#          Find  all  local  processes  connected  to X server.
#
   ss -o state fin-wait-1 '( sport = :http or sport  = :https )' dst 193.233.7/24
#          List all the tcp sockets in state FIN-WAIT-1
#          for our apache to network  193.233.7/24  and
#          look at their timers.
0

You could use netstat, column, and awk:

netstat -anpt | column -t | awk '{print $1,$6,$7}'

This prints the first,sixth,and seventh column.

tcp LISTEN -
tcp LISTEN -
tcp ESTABLISHED 2084/firefox
tcp ESTABLISHED 2084/firefox
tcp6 LISTEN -

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.