netstat date/time a port was opened?

[Craig A. Sharp]

Is there a way to get the date and time a port was opened using netstat or is there a better piece of 'ware out there that can give me better info than netstat?

[Steven E. Protter]

Shalom,

Check the man page, but I think the answer to your question is no.

You might be able to find this with ethtool/wireshark or tcpdump port ## (replace the ## with a real port number).

SEP

[Aussan]

netstat and lsof will give you info about the port but not the date and time, however if you know what is using the port

example port 21 is used by ftp

you can take a look at syslog.log and see the date and time of the ftp session.

i hope this helps

Regards

Aussan

[rick jones]

Neither netstat, nor the underlying transport has that information.

I suspect there may be auditing levels which are high enough that you could see when the socket() and/or bind() calls (I am assuming that is what you mean by "time a port is opened" were made, but that is actually conjecture, for as a performance guy I rarely if ever enable auditing.

If you want to know when a connection was established, you could in theory sniff the network traffic looking for the SYNs and see the timestamps. That has a non-trivial CPU overhead.

To what end do you wish to know this information?