procspy

README

Note: https://github.com/weaveworks/procspy is the more actively maintained version of this library.

Procspy:

Go module to list all TCP connections, with an option to try to find the owning PID and processname.

Works by reading /proc directly on Linux, and by executing netstat and lsof -i on Darwin.

Works for IPv4 and IPv6 TCP connections. Only established connections are listed; ports where something is only listening or TIME_WAITs are skipped.

If you want to find all processes you'll need to run this as root.

Status:

Tested on Linux and Darwin (10.9).

Install:

go install

Usage:

Only list the connections:

cs, err := procspy.Connections(false)
for c := cs.Next(); c != nil; c = cs.Next() {
    ...
}

List the connections and try to find the owning process:

cs, err := procspy.Connections(true)
for c := cs.Next(); c != nil; c = cs.Next() {
    ...
}

(See ./example_test.go)

package main

import (
	"fmt"

	"github.com/alicebob/procspy"
)

func main() {
	lookupProcesses := true
	cs, err := procspy.Connections(lookupProcesses)
	if err != nil {
		panic(err)
	}

	fmt.Printf("TCP Connections:\n")
	for c := cs.Next(); c != nil; c = cs.Next() {
		fmt.Printf(" - %v\n", c)
	}
}

Documentation

Overview

Package procspy lists TCP connections, and optionally tries to find the owning processes. Works on Linux (via /proc) and Darwin (via `lsof -i` and `netstat`). You'll need root to use Processes().

Example

package main

import (
	"fmt"

	"github.com/alicebob/procspy"
)

func main() {
	lookupProcesses := true
	cs, err := procspy.Connections(lookupProcesses)
	if err != nil {
		panic(err)
	}

	fmt.Printf("TCP Connections:\n")
	for c := cs.Next(); c != nil; c = cs.Next() {
		fmt.Printf(" - %v\n", c)
	}
}

Index

• func SetFixtures(c []Connection)
• func SetProcRoot(root string)
• type ConnIter
  • func Connections(processes bool) (ConnIter, error)
• type Connection
• type Proc
• type ProcNet
  • func NewProcNet(b []byte, wantedState uint) *ProcNet
  • func (p *ProcNet) Next() *Connection

Examples

• Package

Functions

func SetFixtures

func SetFixtures(c []Connection)

SetFixtures is used in test scenarios to have known output.

func SetProcRoot

func SetProcRoot(root string)

SetProcRoot sets the location of the proc filesystem.

Types

type ConnIter

type ConnIter interface {
	Next() *Connection
}

ConnIter is returned by Connections().

func Connections

func Connections(processes bool) (ConnIter, error)

Connections returns all established (TCP) connections. If processes is false we'll just list all TCP connections, and there is no need to be root. If processes is true it'll additionally try to lookup the process owning the connection, filling in the Proc field. You will need to run this as root to find all processes.

type Connection

type Connection struct {
	Transport     string
	LocalAddress  net.IP
	LocalPort     uint16
	RemoteAddress net.IP
	RemotePort    uint16

	Proc
	// contains filtered or unexported fields
}

Connection is a (TCP) connection. The Proc struct might not be filled in.

type Proc

type Proc struct {
	PID  uint
	Name string
}

Proc is a single process with PID and process name.

type ProcNet

type ProcNet struct {
	// contains filtered or unexported fields
}

ProcNet is an iterator to parse /proc/net/tcp{,6} files.

func NewProcNet

func NewProcNet(b []byte, wantedState uint) *ProcNet

NewProcNet gives a new ProcNet parser.

func (*ProcNet) Next

func (p *ProcNet) Next() *Connection

Next returns the next connection. All buffers are re-used, so if you want to keep the IPs you have to copy them.