☰

ss 返回的连接持续时间

tag-icon • tag-icon linux bash networking command-line process
ss 返回的连接持续时间

使用ss，我们可以识别本地地址、对等地址和进程。

是否有命令可以返回这些连接的活动时间？

答案1

不幸的是，你必须为此努力。

下面的脚本是一个 hack，试图为您提供您正在寻找的内容。

#!/bin/sh

BASE=`basename "$0" ".sh" `
TMP="/tmp/tmp.$$.${BASE}"

#Netid  State   Recv-Q  Send-Q                        Local Address:Port                                         Peer Address:Port                               Process
#u_str      ESTAB       0            0                                                  * 38100                                * 37262        users:(("(sd-pam",pid=1688,fd=2),("(sd-pam",pid=1688,fd=1),("systemd",pid=1683,fd=2),("systemd",pid=1683,fd=1))

ps axo stat:6,user:15,tty:8,sess,ppid,pid,pcpu,etime,command:60 --columns 256 >${TMP}.pids

ss -p >${TMP}.ss

cat ${TMP}.ss | awk '{
    PIDs="" ; 

    #p=index( $0 , "users:"(("at-spi2-registr",
    p=index( $0 , "users:" ) ;
    rem=substr( $0, p ) ;
    c=index( rem, "," ) ;
    head=substr( rem, 1, c-1 ) ; 
    pname=substr( head, 9 ) ;
    rem=substr(rem, c) ;
    
    while( index( rem, "pid=" ) != 0 ){
        n=index( rem, "pid=" )
        rem=substr( rem, n ) ;
        c=index( rem, "," ) ;
        head=substr( rem, 1, c-1 ) ; 
        PID=substr( head, 5 ) ; 
        PIDs=sprintf("%s|%s", PIDs, PID ) ;
        rem=substr(rem, c) ;
    } ;
    if( PIDs != "" ){
        printf("%s|%s%s\n", $1, pname, PIDs ) ;
    } ;
}' |
while [ true ]
do
    read line
    if [ -z "${line}" ] ; then exit ; fi

    ID=`echo "${line}" | awk -F \| '{ print $1 }' `
    NAM=`echo "${line}" | awk -F \| '{ print $2 }' | sed 's+\"+\\\"+g' `
    PID=`echo "${line}" | awk -F \| '{ print $3 }' `
    cat ${TMP}.pids | awk -v pid=${PID} -v nam="${NAM}" '{ 
        if( $6 == pid ){
            printf("%s %s %s %s\n", $6, $2, $8, nam ) ;
        } ;
    }'
done | sort -n | uniq

输出如下所示：

3014 ericthered 08:06:14 "WebExtensions"
3180 ericthered 08:05:57 "Isolated Web Co"
3834 ericthered 07:50:46 "gvfsd-network"
3841 ericthered 07:50:46 "gvfsd-smb-brows"
3856 ericthered 07:50:44 "gvfsd-dnssd"
4270 ericthered 07:47:12 "caja"
4364 ericthered 07:46:22 "Isolated Web Co"
5274 ericthered 07:07:06 "mate-terminal"
7319 ericthered 04:20:03 "RDD Process"
7487 ericthered 04:18:15 "Utility Process"
12290 ericthered 02:33:00 "Isolated Web Co"
12558 ericthered 02:24:08 "Isolated Web Co"
13947 ericthered 01:10:28 "Isolated Web Co"
14064 ericthered 01:05:48 "Isolated Web Co"
14116 ericthered 01:05:32 "Web Content"
14152 ericthered 01:05:31 "Web Content"
14509 ericthered 38:02 "Web Content"

由您决定保留哪些参数以及如何呈现这些参数。

相关内容