Skip to content

Instantly share code, notes, and snippets.

@staaldraad
Last active November 20, 2024 19:43
Show Gist options
  • Save staaldraad/4c4c80800ce15b6bef1c1186eaa8da9f to your computer and use it in GitHub Desktop.
Save staaldraad/4c4c80800ce15b6bef1c1186eaa8da9f to your computer and use it in GitHub Desktop.
AWK to get details from /proc/net/tcp and /proc/net/udp when netstat and lsof are not available
# Gawk version
# Remote
grep -v "rem_address" /proc/net/tcp | awk '{x=strtonum("0x"substr($3,index($3,":")-2,2)); for (i=5; i>0; i-=2) x = x"."strtonum("0x"substr($3,i,2))}{print x":"strtonum("0x"substr($3,index($3,":")+1,4))}'
# Local
grep -v "rem_address" /proc/net/tcp | awk '{x=strtonum("0x"substr($2,index($2,":")-2,2)); for (i=5; i>0; i-=2) x = x"."strtonum("0x"substr($2,i,2))}{print x":"strtonum("0x"substr($2,index($2,":")+1,4))}'
# No Gawk
# Local
grep -v "rem_address" /proc/net/tcp | awk 'function hextodec(str,ret,n,i,k,c){
ret = 0
n = length(str)
for (i = 1; i <= n; i++) {
c = tolower(substr(str, i, 1))
k = index("123456789abcdef", c)
ret = ret * 16 + k
}
return ret
} {x=hextodec(substr($2,index($2,":")-2,2)); for (i=5; i>0; i-=2) x = x"."hextodec(substr($2,i,2))}{print x":"hextodec(substr($2,index($2,":")+1,4))}'
# Remote
grep -v "rem_address" /proc/net/tcp | awk 'function hextodec(str,ret,n,i,k,c){
ret = 0
n = length(str)
for (i = 1; i <= n; i++) {
c = tolower(substr(str, i, 1))
k = index("123456789abcdef", c)
ret = ret * 16 + k
}
return ret
} {x=hextodec(substr($3,index($3,":")-2,2)); for (i=5; i>0; i-=2) x = x"."hextodec(substr($3,i,2))}{print x":"hextodec(substr($3,index($3,":")+1,4))}'
# All in one
awk 'function hextodec(str,ret,n,i,k,c){
ret = 0
n = length(str)
for (i = 1; i <= n; i++) {
c = tolower(substr(str, i, 1))
k = index("123456789abcdef", c)
ret = ret * 16 + k
}
return ret
}
function getIP(str,ret){
ret=hextodec(substr(str,index(str,":")-2,2));
for (i=5; i>0; i-=2) {
ret = ret"."hextodec(substr(str,i,2))
}
ret = ret":"hextodec(substr(str,index(str,":")+1,4))
return ret
}
NR > 1 {{if(NR==2)print "Local - Remote";local=getIP($2);remote=getIP($3)}{print local" - "remote}}' /proc/net/tcp
@romain-dartigues
Copy link

Thank you!

I know readability is important, but here is a shorter version working on POSIX shell, tested with gawk, nawk and Busybox awk (didn't note the version of each, sorry):

awk $(case "$(awk --version 2>&-)" in GNU*) echo --non-decimal-data;;esac) \
 'function g(s){r=sprintf("%d","0x" substr(s,index(s,":")-2,2));for (i=5;i>0;i-=2){r=r"."sprintf("%d","0x" substr(s,i,2))};return r":"sprintf("%d", "0x" substr(s,index(s,":")+1,4))}NR>1{print g($2),g($3)}'\
 /proc/net/tcp # or /proc/$PID/net/tcp for a process ports

Append a | column -t to make it more readable.

@petermueller
Copy link

Really useful script, thanks for sharing! I've made a little addition to include TCP states, if anyone cares: https://gist.github.com/qistoph/1b0708c888f078c3720de6c6f9562997

I appreciate both of your work!

I updated to make it a little easier to reuse:
https://gist.github.com/petermueller/1b837eddc443857b2051f739818cfad7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment