Determining at what time a currently open TCP connection was created?
Solution 1:
I was able to use lsof
to get the file descriptor, then ran stat /proc/<PID>/fd/<file descriptor>
to get the date.
Solution 2:
A combination of lsof
and /proc
as suggested by @opsguy should do the job:
lsof -P -i tcp | awk '{print $2,$4}' | tr -d 'u' | sort -u \
| while read pid fd; do stat --printf "%z %N\n" /proc/$pid/fd/$fd ; done | sort -r