From e92273d8b6112a0d5e5596d47436f023266d6abe Mon Sep 17 00:00:00 2001 From: Robby Russell Date: Mon, 21 Sep 2026 13:31:46 -0700 Subject: [PATCH] feat(systemadmin)!: match ports 80 and 443 in con80, req20 and http20 The three helpers hard-coded port 80. Most web traffic is HTTPS now, so counting port 80 alone misses most of it. With no argument they now match 80 and 443 together; passing one or more ports narrows them to those (`con80 8080 8443`). http20 also moves -c before the filter expression, since BSD getopt stops at the first non-option argument. BREAKING CHANGE: con80, req20 and http20 now include port 443 by default. Pass the port explicitly (`con80 80`) to get the old behavior. Closes #14114 Co-Authored-By: Claude Fable 5.1 --- plugins/systemadmin/README.md | 6 +++--- plugins/systemadmin/systemadmin.plugin.zsh | 20 +++++++++++++------- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/plugins/systemadmin/README.md b/plugins/systemadmin/README.md index f8266d8d4..6a4f4ad4c 100644 --- a/plugins/systemadmin/README.md +++ b/plugins/systemadmin/README.md @@ -33,10 +33,10 @@ plugins=(... systemadmin) | killit | Kills any process that matches a regular expression passed to it | | tree | List contents of directories in a tree-like format (if tree isn't installed) | | sortcons | Sort connections by state | -| con80 | View all 80 Port Connections | +| con80 | View all connections on ports 80 and 443, or on the ports given as arguments (`con80 8080`) | | sortconip | On the connected IP sorted by the number of connections | -| req20 | List the top 20 requests on port 80 | -| http20 | List the top 20 connections to port 80 based on tcpdump data | +| req20 | List the top 20 requests on ports 80 and 443, or on the ports given as arguments (`req20 8080`) | +| http20 | List the top 20 connections to ports 80 and 443 based on tcpdump data, or to the ports given as arguments | | timewait20 | List the top 20 time_wait connections | | syn20 | List the top 20 SYN connections | | port_pro | Output all processes according to the port number | diff --git a/plugins/systemadmin/systemadmin.plugin.zsh b/plugins/systemadmin/systemadmin.plugin.zsh index 1d95a1ba8..a1820f34b 100644 --- a/plugins/systemadmin/systemadmin.plugin.zsh +++ b/plugins/systemadmin/systemadmin.plugin.zsh @@ -71,11 +71,13 @@ function sortcons() { } | sort | uniq -c | sort -rn } -# View all 80 Port Connections +# View all connections on the given ports (default 80 and 443) function con80() { + local -a ports=($@) + (( $# )) || ports=(80 443) { LANG= ss -nat || LANG= netstat -nat - } | grep -E ":80[^0-9]" | wc -l + } | grep -E ":(${(j:|:)ports})[^0-9]" | wc -l } # On the connected IP sorted by the number of connections @@ -86,17 +88,21 @@ function sortconip() { } | cut -d: -f1 | sort | uniq -c | sort -n } -# top20 of Find the number of requests on 80 port +# top20 of Find the number of requests on the given ports (default 80 and 443) function req20() { + local -a ports=($@) + (( $# )) || ports=(80 443) { - LANG= ss -tn | awk '$4 ~ /:80$/ {print $5}' \ - || LANG= netstat -tn | awk '$4 ~ /:80$/ {print $5}' + LANG= ss -tn | awk -v ports="${(j:|:)ports}" '$4 ~ ":("ports")$" {print $5}' \ + || LANG= netstat -tn | awk -v ports="${(j:|:)ports}" '$4 ~ ":("ports")$" {print $5}' } | awk -F: '{print $1}' | sort | uniq -c | sort -nr | head -n 20 } -# top20 of Using tcpdump port 80 access to view +# top20 of Using tcpdump to view access to the given ports (default 80 and 443) function http20() { - sudo tcpdump -i eth0 -tnn dst port 80 -c 1000 | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | head -n 20 + local -a ports=($@) + (( $# )) || ports=(80 443) + sudo tcpdump -i eth0 -tnn -c 1000 "dst port ${(j: or :)ports}" | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | head -n 20 } # top20 of Find time_wait connection