4

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. I don't believe that this is possible with netstat from everything I've explored so far and so I was thinking that I would have to write a script to process the output of netstat and then pass the pids into ps and then prettify the output to show the ip+port and full command line.

Is there a better way of doing this or is this about the only option?

4

ss -lnptu piped to awk with a call to ps -p. I'm on a mobile device, so it is a little tricky to type out a full example at the moment.

Listening Sockets:

ss -lnptu | awk 'NR>1 { split($7,p,","); printf "Listen: "$5 " Command: "; system("ps --no-headers -o args p "p[2]); }'

All Sockets (will likely require some additional filtering due to sockets without process information in TIME_WAIT, etc):

ss -anptu state listening state established state connected state unconnected | grep -v TIME_WAIT | awk 'NR>1 { split($7,p,","); printf "Listen: "$5 " Command: "; system("ps --no-headers -o args p "p[2]); }'

 

  • Thanks for heads up Mark, looking forward to a more detailed response! – ylluminate Feb 20 '14 at 3:08
  • @ylluminate I added a quick and dirty example. – Mark Sturgill Feb 20 '14 at 3:29
  • Great, thanks yes. Just FYI on CentOS 6.5 it gave me some funky output regarding the arguments that are being passed in: gist.github.com/8a36dbbc3fe9c8371742 – ylluminate Feb 20 '14 at 3:36
  • @ylluminate I tested with Ubuntu 13.04 (ss --version = iproute2-ss130716). Can you give me an example line of output from ss -anptu on your system? – Mark Sturgill Feb 20 '14 at 3:44
  • Sure, here's the raw output: j.mp/1dPtubZ (Apologize, I made it on a wide terminal.) – ylluminate Feb 20 '14 at 3:50
1

I was getting errors from ps on Ubuntu 16.04 when using Mark Sturgill's answer as-is. Needed a slight modification to make it work: basically added an extra split to further isolate the numeric PID from the joined format that ss returns (e.g. pid=1306 -> 1306). I also added the -ww flag to make ps output the full args:

ss -lnptu | awk 'NR>1 { split($7,p,","); split(p[2],pid,"="); printf "Listen: "$5 " Command: "; system("ps --no-headers -ww -o args p "pid[2]); }'
0

@ylluminate, for CentOS change it to ss -lnptu | awk 'NR>1 { split($6,p,","); printf "Listen: "$4 " Command: "; system("ps --no-headers -o args p "p[2]); }'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.