Something similar to netstat ... but quicker.

[Jeffrey Mogul]

In article <1990Nov12.192712.23544 at watcgl.waterloo.edu> bmacinre at watcgl.uwaterloo.ca (Blair MacIntyre) writes:
>If a specific host is connected to my machine, doing a finger, running
>netstat gives the following lines in the output (something similar):
>(I'm on watcgl, someone on seward.tn.cornell.edu is fingering me)
>
>tcp        0      0  watcgl.finger          SEWARD.TN.CORNEL.2997  ESTABLISHED
>tcp        0      0  watcgl.4788            SEWARD.TN.CORNEL.finge ESTABLISHED
>
>To get this info, I have to run netstat (obviously), but this is
>sloooow.

Often "netstat" runs slow because of the cost of translating IP host
addresses to names, via the domain name system.   This is especially
true if the host names are from "far away", since it means you might
have to contact a foreign nameserver for each one.

You can get around this by giving the "-n" flag to netstat.  I ran
netstat on gatekeeper.dec.com, which has a lot of non-local connections,
and timed it:
    with -n:	     0.6u 0.3s 0:02 46% 89+173k 23+1io 0pf+0
    without -n:	    14.7u 1.2s 0:56 28% 91+233k 33+2io 0pf+0w
Kind of dramatic, no?

Of course, you won't know the names of the hosts or services, but
you can look them up afterwards when you find the particular line that
interests you.

This is even more useful with "netstat -r", which tries to look up
lots of network names and usually fails.  On gatekeeper.dec.com:
    with -n:	   1.7u 1.2s 0:08 36% 91+184k 0+1io 0pf+0w
    without -n:	   I got bored and gave up after more than 8 minutes.

This is not a bug in the software, it's inherent in the distributed
way that the Internet's Domain Name System works.

-Jeff