9

Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?

kernelpanic
  • 1,276
  • 1
  • 10
  • 30
  • Related: https://serverfault.com/questions/296853/determining-at-what-time-a-currently-open-tcp-connection-was-created – Nemo Jul 10 '17 at 17:02

4 Answers4

6

The -p option of netstat allows to get the process ID of the process that initiated the connection.
Used in conjunction with the -a (all) and -n (numeric) options

  netstat -anp

The list of sockets is displayed along with useful information

  unix 3  [ ]  STREAM   CONNECTED  60670  7392/firefox-bin

Using ps -ef (or psgrep) get the information associated to the 7392 process, like STIME 

  ps -ef | grep 7392

  UID  PID  PPID  C STIME TTY      TIME CMD
  me  7392  7388  2 09:37 ?    00:01:34 /usr/lib/firefox-3.6.10/firefox-bin

The process was started at 09:37.

Déjà vu
  • 5,546
  • 9
  • 36
  • 55
  • 3
    This only state that the process has started at a certain time it does not provide any information about a specific connection time. Firefox that you give in example, he will establish a lot of connection for the many pages that you open the time of firefox runing has no related information of what time took a connection. – Gopoi Oct 09 '10 at 03:08
  • @Gopoi Of course, this is just an example. I assume the author knows the difference between a process and a connection. This will be relevant if the process starts the connection at first, and dies with it. – Déjà vu Oct 09 '10 at 09:15
5

I have never seen any network structures for holding time a connection was established. The information can be logged by stateful firewalls. However, they only track when the last activity occurred.

In some cases, it is roughly derivable from when the process servicing the connection was created.

BillThor
  • 27,737
  • 3
  • 37
  • 69
4

You can do it with ipclog & constat

Casual Coder
  • 1,216
  • 1
  • 11
  • 12
3

No I checked at the man page of netstat and there is no way of knowing the time of an established connection using netstat.

And I don't think it is stored anywhere because connection are so dynamic.

Gopoi
  • 547
  • 5
  • 21