根据端口抓捕低频发包进程

grep_port.sh

#!/bin/bash

i=1
while(($i>0))
do

    pid=''
    PSPID=''
    GOTED=`ss -natp|grep ESTAB|grep -E ":9003 "`

    if [ -n "$GOTED" ]; then
        pid=`echo $GOTED|awk '{print $6}'|awk -F"," '{print $2}'`
    fi

    if [ -n "$pid" ]; then
        PSPID=`ps aux|grep -v 'grep'|grep $pid`
    fi

    if [ -n "$GOTED$PSPID" ]; then
    echo "==================" >> ./tmp.txt
    echo `date` >> ./tmp.txt
    echo "ss by port : "$GOTED >> ./tmp.txt
    echo "ps by pid  : "$PSPID >> ./tmp.txt
    fi

    sleep 2s

done