[svlug] What's Linux's 'sockstat'?

svlug@gory.org svlug at gory.org
Thu May 30 10:04:42 PDT 2002


On Thu, 30 May, at 09:42:12 -0700, Aaron T Porter <atporter at primate.net> wrote:
> > 
> > The thing which interests me most is the open port report -- more or
> > less an internal nmap.
> 
> 	If you really want to see an "internal nmap" you should take a
> look at 'lsof'. One of the most frequently used tools in my admin box.

Yeah, I've been using lsof as well, but from what I've seen, it doesn't
provide as complete information as sockstat.  I very well could be wrong,
but I'd love to know how to get lsof to show me this info.  Here it is
again:

USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
root     sshd     91182    4 tcp4   192.168.1.28:22       10.1.17.117:2874
root     sshd     91168    4 tcp4   192.168.1.28:22       10.3.11.101:2947
root     sshd     90505    4 tcp4   192.168.1.28:22       10.3.11.101:2872
root     ssh      90408    3 tcp4   192.168.1.83:751      192.168.1.19:22
root     snort    90386    8 tcp4   127.0.0.1:3779        127.0.0.1:3306
root     perl     90379    3 tcp4   127.0.0.1:3814        127.0.0.1:3306
root     sshd     89980    4 tcp4   192.168.1.28:22       10.1.17.117:2631
root     sshd     89936    4 tcp4   192.168.1.28:22       10.1.17.117:2628
root     sshd     72733    4 tcp4   192.168.1.28:22       10.1.17.117:2892
www      httpd    31730    6 tcp4   127.0.0.1:2617        127.0.0.1:3306
www      httpd    31730    7 tcp4   127.0.0.1:3760        127.0.0.1:3306

Thanks for the reply,

-Charlie
-- 
GPG Key fingerprint = 4F36 EC4F 2F2C 5F59 9690  09E5 4C0F 9DB0 8623 53CE
Paradise is exactly like where you are right now ... only much, much better.
		-- Laurie Anderson



More information about the svlug mailing list