Can we get the elapsed time from the netstat command

Question

First let me explain my scenario. We have an application that uses TCP, often freezing due to CLOSE_WAIT connections. From netstat, I can track the remote host for which CLOSE_WAIT is happening. But I want to know the elapsed time (the time CLOSE_WAIT appeared on a specific port). If I know the exact time CLOSE_WAIT, I can analyze the logs corresponding to the timestamp to find any possible reason for this.

I know that I can run netstat at regular intervals. In addition, I can get the exact time window of CLOSE_WAIT connections.

Is there an easier way to get what I need using netstat or any other commands?

Answer 1

You can directly watch traffic with tcpdump. If you know the remote IP address and / or port, you can narrow it down to this traffic.

tcpdump -i eth0 src 192.168.1.1 and port 80