Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I can verify that the connection is up:

$ netstat -tn | grep ""
tcp  0  0  ESTABLISHED

is there a way to check how long this tcp port connection was up (connected)?

(No, I don't have access to app logs)

share|improve this question

2 Answers 2

You can try the following:

  1. get the PID (say $pid) of the program by adding the -p option to netstat.

  2. identify the proper line in the /proc/net/tcp file by looking at the local_address and/or rem_address fields (note that they are in hex format, specifically the IP address is expressed in little-endian byte order);

  3. copy the associated inode field (say $inode);

  4. search for that inode among the file descriptors in /proc/$pid/fd and finally query the file access time of the symbolic link:

    find /proc/$pid/fd -lname "socket:\[$inode\]" -printf %a

That is a grunt work... here's a script (stub) to automatize the above points, it requires the remote address and it prints the socket uptime in seconds:

function suptime() {
    addr=${1:?Specify the remote IPv4 address}
    port=${2:?Specify the remote port number}
    pid=$(netstat -ntp 2>/dev/null | awk '
$6 == "ESTABLISHED" && $5 == "'$addr:$port'"\
{sub("/.*", "", $7); print $7}')
    hex_addr=$(python -c "
import socket, struct;
print hex(struct.unpack('<L',
    hex_port=$(python -c "print hex($port)[2:].upper()")
    inode=$(awk '$3 == "'$hex_addr:$hex_port'" {print $10}' /proc/net/tcp)
    time=$(find /proc/$pid/fd -lname "socket:\[$inode\]" -printf %A@)
    LANG=C printf '%.2fs' $(bc <<<"$(date +%s.%N) - $time")


$ suptime 52639
share|improve this answer

I haven’t seen netstat give that information. A combination of netstat and ps commands should be helpful.

  • Get pid of the socket with netstat.
$ sudo netstat -plan | grep ""

tcp        0      0       ESTABLISHED 2679/chromium-brows
  • Check process details with ps.
$ sudo ps -eo uid,pid,etime | grep 2679

1000  2679       44:31

The third value here is the total time the socket has been running.

To understand ps output better I am pasting the headings.

$  sudo ps -eo uid,pid,etime | head

0     1       52:37
share|improve this answer
if you do this on the sever side, this will give you how long the server was running. I am interested in how long the connection is up. Say the server started last month but the client connected only 2 days ago. In this case, on the server I get "one month" but I am looking for "2 days". –  hidralisk Mar 14 '13 at 23:12
This will in fact tell you how long the connection is up. I think only detailed logging will be able to tell how long the client was connected to the socket. This is definitely a lead. –  ffami Mar 15 '13 at 6:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.