lsof-based_tcp_logger.sh

#!/bin/bash

# Runs 'lsof -i' repeatedly. It tries to notice TCP connections being made and
# broken over time.
#
# This is a very kludgey hack, and may fail to log many connections in the
# middle. A much better solution is to use a tool like the eBPF-based
# tcpconnect, if that's available on your machine.


function _lsof_command() {
    lsof +c0 -iTCP -n -P -s tcp:ESTABLISHED
    #lsof +c0 -iTCP -n -P -s tcp:ESTABLISHED | grep -v '^update_pb_from_.*'
}


CURRENT=$(_lsof_command)

FIRST_LINE=$(echo "$CURRENT" | head -n1)

echo "============================== $(date --iso-8601=ns) =============================="
echo "$CURRENT"

while true
do
    PREVIOUS="$CURRENT"

    CURRENT=$(_lsof_command)

    echo "============================== $(date --iso-8601=ns) =============================="
    DIFF=$( diff <(echo "$PREVIOUS") <(echo "$CURRENT") \
        | grep -vP '^[0-9]+[ad][0-9]+$' )

    if [ -n "$DIFF" ]; then
        echo "$FIRST_LINE"
        echo "$DIFF"
    fi

    # sleep for a very short amount of time, so we don't hog too many resources
    perl -e 'sleep undef,undef,undef,0.2'
done