lstf

lstf prints host flows (aggregated network connection flows to the same source or destination ports) by Linux /proc/net/tcp (netstat -tan) and enables you to simply grasp the network relationship between localhost and other hosts.

friend: yuuki/lsconntrack

Features

• Distinction of active open and passive open
• Print also the number of connections of each flows (the absolute values are meaningless)
• Go portability
• JSON support
• TCP support only

How to use

HTTP requests --> Web:80 --> MySQL:3306

$ lstf -n
Local Address:Port   <-->   Peer Address:Port     Connections
10.0.1.9:many        -->    10.0.1.10:3306        22
10.0.1.9:many        -->    10.0.1.11:3306        14
127.0.0.1:many       -->    10.0.1.20:8080        99
10.0.1.9:80          <--    10.0.2.10:80          120
10.0.1.9:80          <--    10.0.2.11:80          202

• --> indicates active open
• <-- indicates passive open

JSON format

$ lstf -n --json | jq -r -M '.'
[
  {
    "direction": "active",
    "local": {
      "Addr": "localhost",
      "Port": "many"
    },
    "peer": {
      "addr": "10.0.100.1",
      "port": "3306"
    },
    "connections": 20
  },
  {
    "direction": "passive",
    "local": {
      "addr": "localhost",
      "port": "80"
    },
    "peer": {
      "addr": "10.0.200.1",
      "port": "many"
    },
    "connections": 27
  },
  ...
]

License

MIT

Author

yuuki