🖧 Как вывести список исходящих соединений на Linux

Автор cryptoparty На чтение 2 мин Опубликовано 07.09.2023

В продолжении сетевых сетевых советов по Linux.

Ранее мы рассмотрели как спарсить определенный Ip адрес и как узнать шлюз по умолчанию.

Список исходящих соединений.

Список исходящих соединений, у которых порт адреса источника был выделен автоматически.

ss --no-header --numeric --tcp state established "( autobound )"
0                              0                                                         192.168.8.168:55388                                                   151.101.130.114:443
0                              0                                                         192.168.8.168:35856                                                      34.98.64.218:443
0                              0                                                       108.102.106.106:59840                                                    108.162.108.19:8000
0                              0                                                         192.168.8.168:51844                                                   192.109.244.113:443
0                              0                                                         192.168.8.168:43660                                                   173.194.222.188:5228
0                              0                                                         192.168.8.168:52222                                                    18.157.173.201:80
0                              0                                                       108.102.106.106:57292                                                    108.162.108.19:8000
0                              0                                                         192.168.8.168:40822                                                      23.206.90.80:443
0                              0                                                         192.168.8.168:45118                                                       2.16.172.41:443
0                              0                                                         192.168.8.168:36968                                                    91.216.191.100:443
0                              0                                                         192.168.8.168:54580                                                      34.98.64.218:443
0                              0                                                         192.168.8.168:45700                                                     151.101.2.114:443
0                              0                                                             127.0.0.1:59650                                                         127.0.0.1:22
0                              0                                                         192.168.8.168:52774                                                     34.229.201.48:443
0                              0                                                         192.168.8.168:33152                                                     192.168.8.165:22
0                              0                                                       108.102.106.106:43218                                                    108.112.10.118:443
0                              0                                                         192.168.8.168:51984                                                    69.173.144.139:443
0                              0                                                       108.102.106.106:43226                                                    108.112.10.118:443
0                              0                                                       108.102.106.106:55342                                                    100.114.143.77:3000
0                              0                                                         192.168.8.168:34848

Аналогичным образом осуществляется “красивый вывод” исходящих соединений.

(echo -e "Host\tPort\tConnections\n"; ss --no-header --numeric --tcp state established "( autobound )" | awk '{c[$4]++} END{for(l in c) { printf "%s\t%s\n",l,c[l]} }' | tr ':' '\t' | sort --numeric-sort --key 3 --reverse) | column -t
Host             Port  Connections
98.64.218     443   2
112.10.118   443   2
162.108.19   8000  2
216.191.100   443   1
173.144.139   443   1
229.201.48    443   1
206.90.80     443   1
16.172.41      443   1
0.160.130    443   1
168.8.165    22    1
109.244.113  443   1
157.173.201   80    1
194.222.188  5228  1
101.2.114    443   1
101.130.114  443   1
0.0.1        22    1
114.143.77   3000  1

Можно использовать более продуманный фильтр.

echo "( ( $(ip --json  address | jq --raw-output '.[].addr_info | .[] | .local' | paste -s |  sed -e 's/\([0-9a-f.:]\+\)/( src [\1] \&\& ! dst [\1] )/g' -e 's/\t/ || /g') ) and sport > 1024 )"
( ( ( src [127.0.0.1] && ! dst [127.0.0.1] ) || ( src [192.168.8.168] && ! dst [192.168.8.168] ) || ( src [108.102.106.106] && ! dst [108.102.106.106] ) ) and sport > 1024 )
(echo -e "Host\tPort\tConnections\n"; ss --no-header --numeric --tcp state established "( ( $(ip --json  address | jq --raw-output '.[].addr_info | .[] | .local' | paste -s |  sed -e 's/\([0-9a-f.:]\+\)/( src [\1] \&\& ! dst [\1] )/g' -e 's/\t/ || /g') ) and sport > 1024 )" | awk '{c[$4]++} END{for(l in c) { printf "%s\t%s\n",l,c[l]} }' | tr ':' '\t' | sort --numeric-sort --key 3 --reverse) | column -t
Host             Port  Connections
112.10.118   443   2
216.191.100   443   1
229.201.48    443   1
58.215.78    443   1
168.8.165    22    1
109.244.113  443   1
199.109.133  443   1
157.173.201   80    1
194.222.188  5228  1
250.203.195  443   1
114.143.77   3000  1

см. также: