BASH / NETSTAT / SED / AWK Script (ESTABLISHED connections)

elalexluna83 · 09-20-2016, 12:39 PM

Hello Everyone.
Running the next command i got:

Code:

/usr/bin/netstat -neopa | /usr/bin/grep 'ESTABLISHED' | awk '{ printf ("%-20s %-13s %-25s %-8s\n",$9,$1,$4,$5) }' > established.out

cat established.out
20740/firefox        tcp           10.4.4.120:40140          74.125.192.100:443
20740/firefox        tcp           10.4.4.120:49344          173.194.207.136:443
6791/taskldr         tcp           10.5.75.82:41658          50.97.124.80:1352
6390/notes           tcp           10.5.75.82:41743          169.45.4.170:1352

The question here is.
How can i separate port from the ip. i'd like something like ...

Code:

20740/firefox        tcp           10.4.4.120  40140          74.125.192.100   443
20740/firefox        tcp           10.4.4.120  49344          173.194.207.136  443
6791/taskldr         tcp           10.5.75.82  41658          50.97.124.80    1352
6390/notes           tcp           10.5.75.82  41743          169.45.4.170    1352

It will be a plus removing the PID from the process.

Any help will be appreciated.

danielbmartin · 09-20-2016, 12:45 PM

Consider using sed to replace the first colon with two blanks.

Daniel B. Martin

grail · 09-20-2016, 12:57 PM

You don't need the grep just have awk perform all the tasks you want. You can use sub, gsub, gensub or split to get rid of the colons and similar to remove the pid

elalexluna83 · 09-20-2016, 01:20 PM

FOund the solution.

Code:

/usr/bin/netstat -neopa | /usr/bin/grep 'ESTABLISHED' | awk '{ print $9,$1,$4,$5 }' | sed -e 's/\// /g' -e 's/:/  /g' | awk -F " " '{ printf ("%-18s %-17s %-13s %-18s %-20s %-20s\n",$2,$3,$4,$5,$6,$7) }'

Ple share anything faster or better.

grail · 09-20-2016, 01:52 PM

Code:

/usr/bin/netstat -neopa | awk '/ESTABLISHED/{sub(/[^a-z]*/,"",$9);sub(/:/,"  ",$4);sub(/:/,"  ",$5);printf ("%-20s %-13s %-25s %-8s\n",$9,$1,$4,$5)}'

ctsgnb · 10-12-2016, 04:10 AM

Just another way ...

Quote:

netstat -neopa | awk '/ESTAB/{split($4,S,":");split($5,T,":");printf ("%-25s %-s7 %-15s %-5s\t%-15s%-5s\n",$9,$1,S[1],S[2],T[1],T[2])}'