15

How can I find out at what time a currently open TCP connection was established on Linux?

opsguy
  • 801
  • 1
  • 5
  • 12
  • 1
    So, you have solved this problem and you don't have an actual question? – Sven Aug 02 '11 at 20:55
  • 1
    Again: Is this a problem for you or do you want to force a discussion? In the question recently closed you stated that you solved this. – Sven Aug 02 '11 at 21:25
  • I have a solution, but wanted to see if there was another way to do this. Is it really that shameful on here to ask an interesting question that you already know the answer to in here? I couldn't find anything via google and figured this might help someone in the future. – opsguy Aug 02 '11 at 21:28
  • 1
    I note that the old closed question was recently edited, removing the line indicating that opsguy already had the solution. Bad form. – mdpc Aug 02 '11 at 21:32
  • 3
    Final comment, why not contribute the answer own answer anyway instead of trying to quiz people? I'm sure they would be appreciative and you might even get a point or two instead of earning scorn. – mdpc Aug 02 '11 at 21:33
  • 1
    @opsguy Your question is not a discussion question nor a subjective one. It's a legit question that's good Google fodder. No, you are not barred from asking a question that you have the answer to. The question fits within the guidelines. – Wesley Aug 02 '11 at 21:34
  • 2
    We do like people to drop solutions to problems, so go ahead and post yours. If other people have better/different solutions, the better off we all are. – sysadmin1138 Aug 02 '11 at 21:35
  • I thought it was bad form to ask a question and then accept your own answer, and figured I'd give someone else the chance. Also, I am asking to see if there are other solutions, and once there is an accepted solution (mine) the chance of any alternate solutions emerging becomes nil. The edit was to try to make the question clearer since apparently it was too complicated. – opsguy Aug 02 '11 at 21:38
  • 5
    http://blog.stackoverflow.com/2011/07/its-ok-to-ask-and-answer-your-own-questions/ It's perfectly acceptable to ask a question and then answer it yourself. – user9517 Aug 02 '11 at 21:39
  • @SysAdmin1138 So if this is an okay question, should we repoen the first question and close this one? http://serverfault.com/questions/296835/how-can-i-tell-when-a-tcp-connection-was-created-on-linux Oh, and if it's a good question, let's see some upvotes for it. =) – Wesley Aug 02 '11 at 21:43
  • @lain Ah-ha! Much clearer now, thank you! – opsguy Aug 02 '11 at 21:45
  • @WesleyDavid Better, I merged the two questions since they're very similar. – sysadmin1138 Aug 02 '11 at 21:49

2 Answers2

15

I was able to use lsof to get the file descriptor, then ran stat /proc/<PID>/fd/<file descriptor> to get the date.

opsguy
  • 801
  • 1
  • 5
  • 12
6

A combination of lsof and /proc as suggested by @opsguy should do the job:

lsof -P -i tcp | awk '{print $2,$4}' | tr -d 'u' | sort -u \
| while read pid fd; do stat --printf "%z %N\n" /proc/$pid/fd/$fd ; done | sort -r
Andrew Schulman
  • 8,811
  • 21
  • 32
  • 47
the brx in the walls
  • 61
  • 1
  • 1