LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 07-26-2011, 02:49 AM   #1
Tryum
LQ Newbie
 
Registered: Oct 2010
Distribution: Zenwalk
Posts: 19

Rep: Reputation: 0
Using lsof or netstat to view all IPs connected to my host


I have found a command that finds all established connections to my host through TCP connection.

I found the following command as useful:
Code:
netstat -lantp | grep ESTABLISHED | awk '{print $4" "$5" "$7}' | sort -u
Better (application name at the beginning):
Code:
netstat -lantp | grep ESTABLISHED | awk '{print $7" "$4" "$5}' | sort -u

My questions are as follows:
  1. How do I stripping the number of the process with the command netstat? (displaying only the process name)
    • How can I limit the length of the process name to 5 or 8 letters?
  2. How do I strip the local IP address? (i.e. 192.168.1.1)

Example output:
Code:
<process_name> <local_port> <remote_ip>:<remote_port>
The current output of netstat is:
Code:
netstat -lantp | grep ESTABLISHED | awk '{print $7, $4, $5}' | sort -u
Code:
2784/transmission-g 192.168.1.1:<local_port> <remote_ip>:<remote_port>
2965/cmus 192.168.1.1:<local_port> 206.217.216.84:80
The current output of lsof is:
Code:
lsof -i -n -P | grep ESTABLISHED |awk '{print $1, $9}' | sort -u
Code:
cmus 192.168.1.1:<local_port>->206.217.216.84:80
transmiss 192.168.1.1:<local_port>-><remote_ip>:<remote_port>


The Desired//Wanted output:
Code:
<process_name> <local_port> <remote_ip>:<remote_port>

Last edited by Tryum; 07-26-2011 at 03:01 AM.
 
Old 07-26-2011, 03:49 AM   #2
angel115
Member
 
Registered: Jul 2005
Location: France / Ireland
Distribution: Debian mainly, and Ubuntu
Posts: 494

Rep: Reputation: 75
Try this and tell me if it does what you are expected
Code:
netstat -lantp | grep ESTABLISHED | awk '{print $7, $4, $5}' | sort -u |sed 's/[0-9]*\///g'
give me this
sshd: 10.0.1.1:22 192.6.2.99:63187

Last edited by angel115; 07-26-2011 at 04:11 AM.
 
Old 07-26-2011, 04:08 AM   #3
angel115
Member
 
Registered: Jul 2005
Location: France / Ireland
Distribution: Debian mainly, and Ubuntu
Posts: 494

Rep: Reputation: 75
or here it is a longer version but which does what you want:
Code:
netstat -lantp | grep ESTABLISHED | awk '{print $7, $4, $5}' | sort -u |sed -e 's/[0-9]*\/\(.*\):\s[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}:\([0-9]\{1,5\}\)/\1 \2/g'
Gave me the following output
sshd 22 192.6.2.99:63187


Best regards,
Angel.

Last edited by angel115; 07-26-2011 at 04:13 AM. Reason: Correcting minor Regex mistake
 
Old 06-14-2012, 12:06 PM   #4
Tryum
LQ Newbie
 
Registered: Oct 2010
Distribution: Zenwalk
Posts: 19

Original Poster
Rep: Reputation: 0
Shame on me. I have neglected this thread for almost a year.

Code:
netstat -lantp | grep ESTABLISHED | awk '{print $7, $4, $5}' | sort -u |sed 's/[0-9]*\///g'
mocp 192.168.1.2:54168 178.159.0.11:7506

Code:
netstat -lantp | grep ESTABLISHED | awk '{print $7, $4, $5}' | sort -u |sed -e 's/[0-9]*\/\(.*\):\s[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}:\([0-9]\{1,5\}\)/\1 \2/g'
5709/mocp 192.168.1.2:54168 178.159.0.11:7506


It should be mocp 54168 178.159.0.11:7506

Last edited by Tryum; 06-14-2012 at 12:11 PM.
 
  


Reply

Tags
ip, lsof, netstat


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
PS/NETSTAT/LSOF AARGH!! Please Help Me x81kilo Red Hat 1 12-09-2010 12:59 PM
Need link to using netstat and lsof together howto skola Linux - Security 3 11-30-2009 07:50 AM
LXer: lsof Exposes Anyone Connected to Your Linux Computer LXer Syndicated Linux News 0 05-02-2009 04:20 AM
Active connections conundrum involving lsof / netstat output uncle-c Linux - Newbie 8 12-09-2007 10:56 AM
using netstat /lsof to good effects Swakoo Linux - Security 6 05-27-2007 10:52 PM


All times are GMT -5. The time now is 08:05 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration