Compare commits

...
Author SHA1 Message Date
Robby RussellandClaude Fable 5.1 e92273d8b6 feat(systemadmin)!: match ports 80 and 443 in con80, req20 and http20
The three helpers hard-coded port 80. Most web traffic is HTTPS now, so
counting port 80 alone misses most of it. With no argument they now
match 80 and 443 together; passing one or more ports narrows them to
those (`con80 8080 8443`).

http20 also moves -c before the filter expression, since BSD getopt
stops at the first non-option argument.

BREAKING CHANGE: con80, req20 and http20 now include port 443 by
default. Pass the port explicitly (`con80 80`) to get the old behavior.

Closes #14114

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-21 13:38:08 -07:00
2 changed files with 16 additions and 10 deletions
+3 -3
View File
@@ -33,10 +33,10 @@ plugins=(... systemadmin)
| killit | Kills any process that matches a regular expression passed to it |
| tree | List contents of directories in a tree-like format (if tree isn't installed) |
| sortcons | Sort connections by state |
| con80 | View all 80 Port Connections |
| con80 | View all connections on ports 80 and 443, or on the ports given as arguments (`con80 8080`) |
| sortconip | On the connected IP sorted by the number of connections |
| req20 | List the top 20 requests on port 80 |
| http20 | List the top 20 connections to port 80 based on tcpdump data |
| req20 | List the top 20 requests on ports 80 and 443, or on the ports given as arguments (`req20 8080`) |
| http20 | List the top 20 connections to ports 80 and 443 based on tcpdump data, or to the ports given as arguments |
| timewait20 | List the top 20 time_wait connections |
| syn20 | List the top 20 SYN connections |
| port_pro | Output all processes according to the port number |
+13 -7
View File
@@ -71,11 +71,13 @@ function sortcons() {
} | sort | uniq -c | sort -rn
}
# View all 80 Port Connections
# View all connections on the given ports (default 80 and 443)
function con80() {
local -a ports=($@)
(( $# )) || ports=(80 443)
{
LANG= ss -nat || LANG= netstat -nat
} | grep -E ":80[^0-9]" | wc -l
} | grep -E ":(${(j:|:)ports})[^0-9]" | wc -l
}
# On the connected IP sorted by the number of connections
@@ -86,17 +88,21 @@ function sortconip() {
} | cut -d: -f1 | sort | uniq -c | sort -n
}
# top20 of Find the number of requests on 80 port
# top20 of Find the number of requests on the given ports (default 80 and 443)
function req20() {
local -a ports=($@)
(( $# )) || ports=(80 443)
{
LANG= ss -tn | awk '$4 ~ /:80$/ {print $5}' \
|| LANG= netstat -tn | awk '$4 ~ /:80$/ {print $5}'
LANG= ss -tn | awk -v ports="${(j:|:)ports}" '$4 ~ ":("ports")$" {print $5}' \
|| LANG= netstat -tn | awk -v ports="${(j:|:)ports}" '$4 ~ ":("ports")$" {print $5}'
} | awk -F: '{print $1}' | sort | uniq -c | sort -nr | head -n 20
}
# top20 of Using tcpdump port 80 access to view
# top20 of Using tcpdump to view access to the given ports (default 80 and 443)
function http20() {
sudo tcpdump -i eth0 -tnn dst port 80 -c 1000 | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | head -n 20
local -a ports=($@)
(( $# )) || ports=(80 443)
sudo tcpdump -i eth0 -tnn -c 1000 "dst port ${(j: or :)ports}" | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | head -n 20
}
# top20 of Find time_wait connection