Linux commands to view all the connection process specified information

A function that often needs to be used to locate a network failure in a process is to find information about all connections. Usually find a port connection information using ss or netstat can easily get, if it is active with other machines to establish the connection information can be obtained through the lsof command.

For example, I want to see the process frps all the current pid connection information, first obtain the process:

ps -ef|grep frps



The result is:



wcl       4721     1  0 10:27 ?        00:00:01 ./frps

You can see the process pid 4721 , and then through the lsof command to view all the TCP connection information :

lsof -p 4721 -nP | grep TCP





frps    4721  wcl    4u     IPv6 117051764      0t0     TCP *:7000 (LISTEN)

frps    4721  wcl    6u     IPv6 117051765      0t0     TCP *:7003 (LISTEN)

frps    4721  wcl    7u     IPv6 117092563      0t0     TCP 139.129.11.120:7000->116.231.70.223:61545 (ESTABLISHED)

frps    4721  wcl    8u     IPv6 117092565      0t0     TCP *:6000 (LISTEN)

frps    4721  wcl    9u     IPv6 117334426      0t0     TCP 139.129.11.120:7000->116.237.93.230:64898 (ESTABLISHED)

frps    4721  wcl   10u     IPv6 117053538      0t0     TCP 139.129.11.120:7000->115.231.20.123:41297 (ESTABLISHED)

frps    4721  wcl   11u     IPv6 117053540      0t0     TCP *:6005 (LISTEN)

frps    4721  wcl   12u     IPv6 117334428      0t0     TCP *:6004 (LISTEN)

From the lsof output can clearly see the frps process to monitor the five ports, and in the 7000 port on the establishment of the three connections , connect the two ends of the ip information can also be found.

The -nP parameter of lsof is used to display the ip address and port number as normal numeric types, otherwise it may be represented by aliases.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.