TCP Connection Event Logger

TCP Connection Event Logger monitors live Linux kernel socket tables (/proc/net/tcp,
/proc/net/tcp6, /proc/net/udp, and /proc/net/udp6) and records a timestamped history of
opened, state-changed, and closed network connections. A lightweight Linux alternative
to TcpLogView for network troubleshooting, service auditing, and socket lifecycle analysis.

Key features:
- Configurable Polling Engine: Polls /proc/net TCP/UDP IPv4 and IPv6 kernel tables at
configurable intervals from 250 ms to 5 seconds and diffs active socket endpoints across ticks.
- Connection Lifecycle Tracking: Logs timestamped OPENED, STATECHANGE (such as SYNSENT
to ESTABLISHED to TIME_WAIT), and CLOSED socket events with measured connection duration.
- UID, Inode & Process Cross-Reference: Resolves socket UIDs to local usernames, records
kernel socket inodes and Tx/Rx queue depths, and maps accessible /proc/<pid>/fd descriptors.
- State Distribution & Structured Export: Renders live TCP/UDP state distribution charts
and exports filtered or complete connection event logs to CSV and JSON files.

Disclaimer: This project is an independent open-source tool and is not affiliated with, sponsored by, or endorsed by NirSoft.