Monitoring TCP connections easier and faster in SLES | SUSE Communities

Monitoring TCP connections easier and faster in SLES


License: GPLv3


Parsing <i>netstat</i> output has always been a pain because of the large amount of data that is available. Sometimes I need some information more than others, but I almost always want to quickly see the total number and type of connection I have.


For this purpose I use the following command:

netstat -nap | awk '/tcp/ {print $6}'| sort | uniq -c

The output gives me a quick view of how the connections are even comparing them to other servers.

somecoolhost:~ # netstat -nap | awk '/tcp/ {print $6}'| sort | uniq -c
    400 CLOSE_WAIT
      2 FIN_WAIT1
      8 FIN_WAIT2
     38 LISTEN
    271 TIME_WAIT
somecoolhost:~ # 

This can be supplemented with a more advanced script, put it in a cron job sending the output to a log and creating graphical statistics, etc.


Do not forget that we can obtain more complete summary statistics for each protocol with:

netstat -s
(Visited 1 times, 1 visits today)


  • Avatar photo jengelh says:

    What a Rube Goldberg machine. It is so much easier to get the state counts: `ss -s | grep ^TCP:` (even the crappy netstat knows -s!)

    • Avatar photo debianized says:

      Yes, it is another option, but in my case, I need more information and that format is awful, so I use netstat.


      • Avatar photo jengelh says:

        In that case, you might want to consider using the tcp_diag Netlink interface to obtain the desired information directly and print it the way you like.

        • Avatar photo debianized says:

          Oh Kernel Modules, that are others words. If it is true that ss “intends” replace netcat, to me yet still works for what I need.
          Thanks for you feedback.

  • Leave a Reply

    Your email address will not be published. Required fields are marked *

    Avatar photo