TCP monitoring on a server: comparing netstat vs lsof?

Solution 1:

I prefer lsof because it's output is consistent across all platforms on which it runs. You can pretty much get the same info from both programs, though. I think it comes down to personal preference.

Solution 2:

My first implication would be to use netstat -ptan which will give you all the information you are looking for. Probably pipe to sort and uniq. The following should give you a good number of socket status'.

netstat -ptan | awk '{print $6 " " $7 }' | sort | uniq -c

Solution 3:

Check out dstat and run with:

% sudo dstat --tcp

Even better, if you want to analyze the output, you can have it write to CSV with --output.