Comment Re:man lsof -or- appropos list open connections (Score 2) 65
think this as wireshark and lsof/netstat/ss had a child
it sniff network traffic via the kernel, show what connections open and close and log them per PID
So wireshark without dumping ALL the traffic payload, that can identify to what PID it belongs and all in real time, something lsof/netstat/ss can only show in THAT exact moment, not during time (so fail to detect short live requests)