5

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. I don't believe that this is possible with netstat from everything I've explored so far and so I was thinking that I would have to write a script to process the output of netstat and then pass the pids into ps and then prettify the output to show the ip+port and full command line.

Is there a better way of doing this or is this about the only option?

3 Answers 3

4

ss -lnptu piped to awk with a call to ps -p. I'm on a mobile device, so it is a little tricky to type out a full example at the moment.

Listening Sockets:

ss -lnptu | awk 'NR>1 { split($7,p,","); printf "Listen: "$5 " Command: "; system("ps --no-headers -o args p "p[2]); }'

All Sockets (will likely require some additional filtering due to sockets without process information in TIME_WAIT, etc):

ss -anptu state listening state established state connected state unconnected | grep -v TIME_WAIT | awk 'NR>1 { split($7,p,","); printf "Listen: "$5 " Command: "; system("ps --no-headers -o args p "p[2]); }'

 

8
  • Thanks for heads up Mark, looking forward to a more detailed response!
    – ylluminate
    Feb 20, 2014 at 3:08
  • @ylluminate I added a quick and dirty example. Feb 20, 2014 at 3:29
  • Great, thanks yes. Just FYI on CentOS 6.5 it gave me some funky output regarding the arguments that are being passed in: gist.github.com/8a36dbbc3fe9c8371742
    – ylluminate
    Feb 20, 2014 at 3:36
  • @ylluminate I tested with Ubuntu 13.04 (ss --version = iproute2-ss130716). Can you give me an example line of output from ss -anptu on your system? Feb 20, 2014 at 3:44
  • Sure, here's the raw output: j.mp/1dPtubZ (Apologize, I made it on a wide terminal.)
    – ylluminate
    Feb 20, 2014 at 3:50
2

I was getting errors from ps on Ubuntu 16.04 when using Mark Sturgill's answer as-is. Needed a slight modification to make it work: basically added an extra split to further isolate the numeric PID from the joined format that ss returns (e.g. pid=1306 -> 1306). I also added the -ww flag to make ps output the full args:

ss -lnptu | awk 'NR>1 { split($7,p,","); split(p[2],pid,"="); printf "Listen: "$5 " Command: "; system("ps --no-headers -ww -o args p "pid[2]); }'
1
  • Also note that the command explodes with IPv6 so as workaround you can add a -4 in your ss arguments. Feb 16, 2021 at 15:17
0

@ylluminate, for CentOS change it to ss -lnptu | awk 'NR>1 { split($6,p,","); printf "Listen: "$4 " Command: "; system("ps --no-headers -o args p "p[2]); }'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .