Cheap iftop

watch 'netstat -anptu |egrep "^Proto|:80 "'
Shows updated status in a terminal window for connections to port '80' in a human-friendly form. Use 'watch -n1' to update every second, and 'watch -d' to highlight changes between updates. If you wish for status updates on a port other than '80', always remember to put a space afterwards so that ":80" will not match ":8080".
Sample Output
Every 2.0s: netstat -anptu |egrep "^Proto|:80 "                            Wed May 18 11:03:25 2011

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     18418/apache
tcp        0      0 64.xxx.183.xxx:80        213.xxx.243.xxx:21370  SYN_RECV   -
tcp        0      0 64.xxx.183.xxx:80        213.xxx.243.xxx:6465   SYN_RECV   -
tcp        0      0 64.xxx.202.xxx:80        213.xxx.243.xxx:30703  SYN_RECV   -
tcp        0      0 64.xxx.202.xxx:80        64.xxx.202.xxx:39600   TIME_WAIT  -
tcp        0      0 64.xxx.202.xxx:80        64.xxx.202.xxx:39601   TIME_WAIT  -

7
By: Mozai
2011-05-18 15:05:52

1 Alternatives + Submit Alt

What Others Think

nice but won't tell me which vhost the connection went to or to which hosted site. any chance to see this info too?
Ovidiu · 370 weeks and 5 days ago
watch -dn2 'netstat -anptu | egrep "^Proto|:80" | sort' will watch on ports 80 and 8080 and sort output if u have a lot of connections, highliting changes with update interval 2 sec.
ilrandir · 370 weeks and 3 days ago
Ovidiu: When you say vhost, do you mean a protocol thing, like the domain part of the "RCPT TO:" lines of SMTP? In that case, you'll need packet inspection -- you're better off doing a 'tail -f logfile |grep ' instead.
Mozai · 369 weeks and 4 days ago
ilrandir : I already mentioned using other values for "-n" in the comment.
Mozai · 369 weeks and 4 days ago

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands



Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: