Showing date/time in netstat

Question

Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?

Answer 1

You can do it with ipclog & constat

Answer 2

No I checked at the man page of netstat and there is no way of knowing the time of an established connection using netstat.

And I don't think it is stored anywhere because connection are so dynamic.

Answer 3

I have never seen any network structures for holding time a connection was established. The information can be logged by stateful firewalls. However, they only track when the last activity occurred.

In some cases, it is roughly derivable from when the process to servicing the connection was created.

Answer 4

The -p option of netstat allows to get the process ID of the process that initiated the connection.
Used in conjunction with the -a (all) and -n (numeric) options

  netstat -anp

The list of sockets is displayed along with useful information

  unix 3  [ ]  STREAM   CONNECTED  60670  7392/firefox-bin

Using ps -ef (or psgrep) get the information associated to the 7392 process, like STIME

  ps -ef | grep 7392

  UID  PID  PPID  C STIME TTY      TIME CMD
  me  7392  7388  2 09:37 ?    00:01:34 /usr/lib/firefox-3.6.10/firefox-bin

The process was started at 09:37.