Showing date/time in netstat
Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?
You can do it with ipclog & constat
The -p
option of netstat
allows to get the process ID of the process that initiated the connection.
Used in conjunction with the -a
(all) and -n
(numeric) options
netstat -anp
The list of sockets is displayed along with useful information
unix 3 [ ] STREAM CONNECTED 60670 7392/firefox-bin
Using ps -ef
(or psgrep
) get the information associated to the 7392 process, like STIME
ps -ef | grep 7392
UID PID PPID C STIME TTY TIME CMD
me 7392 7388 2 09:37 ? 00:01:34 /usr/lib/firefox-3.6.10/firefox-bin
The process was started at 09:37.
I have never seen any network structures for holding time a connection was established. The information can be logged by stateful firewalls. However, they only track when the last activity occurred.
In some cases, it is roughly derivable from when the process to servicing the connection was created.
No I checked at the man page of netstat and there is no way of knowing the time of an established connection using netstat.
And I don't think it is stored anywhere because connection are so dynamic.