netstat

README

netstat for go

Package netstat helps you query open network connections.

Getting Started

import "github.com/bastjan/netstat"

// Query open tcp sockets
netstat.TCP.Connections()

// Query open udp sockets for ipv6 connections
netstat.UDP6.Connections()

See netstat_tulpen.go for a more throughout example.

Development Status: Stable

This library is v1 and follows SemVer.

No breaking changes will be made to exported APIs before v2.0.0.

Support for Mac OS and *BSD

There is currently no support planned for MacOS or *BSD without procfs support.

Documentation

Overview

Package netstat helps you query open network connections.

Netstat searches the proc filesystem to gather information about open network connections and the associated processes.

There is currently no support planned for Mac OS or *BSD without procfs support.

Index

• Variables
• type Connection
  • func (c *Connection) User() (*user.User, error)
• type Protocol
  • func (p *Protocol) Connections() ([]*Connection, error)
• type TCPState
  • func (i TCPState) String() string

Variables

var (
	// TCP contains the standard location to read open TCP IPv4 connections.
	TCP = &Protocol{"tcp", "net/tcp"}
	// TCP6 contains the standard location to read open TCP IPv6 connections.
	TCP6 = &Protocol{"tcp6", "net/tcp6"}
	// UDP contains the standard location to read open UDP IPv4 connections.
	UDP = &Protocol{"udp", "net/udp"}
	// UDP6 contains the standard location to read open UDP IPv6 connections.
	UDP6 = &Protocol{"udp6", "net/udp6"}
)

var ProcRoot = "/proc"

ProcRoot should point to the root of the proc file system

Types

type Connection

type Connection struct {
	// Exe contains the path to the process.
	// Exe is empty if there was an error reading /proc/pid/exe.
	Exe string
	// Cmdline contains the complete command line for the process split by \000. Trailing \000 removed.
	// Returns an empty array if /proc/pid/cmdline can't be read.
	Cmdline []string
	// Pid contains the pid of the process. Is zero if open connection can't be assigned to a pid.
	Pid int

	// UserID represents the user account id of the user owning the socket.
	// On Linux systems it is usually a uint32.
	// Type string was chosen because os/user.LookupId() wants a string.
	UserID string

	// Inode contains the inode for the open connection.
	Inode uint64

	// IP holds the local IP for the connection.
	IP net.IP
	// Port holds the local port for the connection.
	Port int
	// RemoteIP holds the remote IP for the connection.
	RemoteIP net.IP
	// RemotePort holds the remote port for the connection.
	RemotePort int
	// State represents the state of a TCP connection. The UDP 'states' shown
	// are recycled from TCP connection states and have a slightly different meaning.
	State TCPState

	// TransmitQueue is the outgoing data queue in terms of kernel memory usage in bytes.
	TransmitQueue uint64
	// ReceiveQueue is the incoming data queue in terms of kernel memory usage in bytes.
	ReceiveQueue uint64

	// Protocol contains the protocol this connection was discovered with.
	Protocol *Protocol
}

Connection contains the gathered information about an open network connection.

func (*Connection) User

func (c *Connection) User() (*user.User, error)

User looks up the user owning the socket. If the user cannot be found, the returned error is of type UnknownUserIdError.

type Protocol

type Protocol struct {
	// Name contains the protocol name. Not used internally.
	Name string
	// RelPath is the proc file path relative to ProcRoot
	RelPath string
}

Protocol points to a file in the proc filesystem where information about open sockets can be gathered.

func (*Protocol) Connections

func (p *Protocol) Connections() ([]*Connection, error)

Connections queries the given /proc/net file and returns the found connections. Returns an error if the /proc/net file can't be read.

type TCPState

type TCPState int

TCPState represents the state of a TCP connection https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/net/tcp_states.h?id=HEAD#n16.

const (
	// TCPUnknown is an unknown state, 00 in /proc/net.
	TCPUnknown TCPState = iota //

	TCPEstablished // ESTABLISHED
	TCPSynSent     // SYN_SENT
	TCPSynRecv     // SYN_RECV
	TCPFinWait1    // FIN_WAIT1
	TCPFinWait2    // FIN_WAIT2
	TCPTimeWait    // TIME_WAIT
	TCPClose       // CLOSE
	TCPCloseWait   // CLOSE_WAIT
	TCPLastAck     // LAST_ACK
	TCPListen      // LISTEN
	TCPClosing     // CLOSING
	TCPNewSynRecv  // NEW_SYN_RECV
)

func (TCPState) String

func (i TCPState) String() string