added new file that checks for any new listening sockets via ss

[WajeehJ]

ss -lt before/after snapshot with delta analysis

Enhancement:
Add support for collecting listening TCP socket information using ss -lt at the
start and end of a profiling run, and automatically computing a delta report that
shows which sockets were added, removed, or had their queue depths change during
the profiled period.

Purpose:
Provides listening TCP socket trend analysis alongside the existing before/after
statistics already collected by LPCPU (netstat, interrupts, meminfo, etc.). The
delta report is useful for spotting services that started or stopped listening
during a workload, and for identifying connection backlog buildup on busy ports.

Changes: lpcpu/lpcpu.sh

1. New helper function — tool detection

function has_ss() {
command -v ss >/dev/null 2>&1
}
2. Before snapshot — ss -lt captured if ss is available

Added inside the before-profiling block. Guarded by has_ss() so the script
does not fail on systems without iproute2:

if has_ss; then
ss -lt > $LOGDIR/ss-sockets.before 2>&1
fi
3. After snapshot — ss -lt captured if ss is available

Added inside the after-profiling block, mirroring the before snapshot:

if has_ss; then
ss -lt > $LOGDIR/ss-sockets.after 2>&1
fi
4. Postprocessing hook — delta report generated automatically

Added to the postprocess.sh generation block so the diff runs when the user
post-processes a collected dataset. The script only runs if both snapshot
files exist and the diff tool is executable:

echo 'SSDIFF="${LPCPUDIR}/tools/ss-lt-diff.py"' >> $LOGDIR/postprocess.sh
echo 'if [ -x ${SSDIFF} -a -e ss-sockets.before -a -e ss-sockets.after ];
then python3 ${SSDIFF} ss-sockets.before ss-sockets.after
> ss-sockets.diff; fi' >> $LOGDIR/postprocess.sh
Output files produced:
ss-sockets.before raw ss -lt output at profiling start
ss-sockets.after raw ss -lt output at profiling end
ss-sockets.diff delta report produced by ss-lt-diff.py

New file: lpcpu/tools/ss-lt-diff.py

A new Python 3 script that reads two ss -lt snapshot files and produces a
human-readable delta report. Sockets are matched by their unique key:
(local address, local port, peer address, peer port).

Output format:

[+] socket added during profiling — shows actual queue values from after
[-] socket removed during profiling — shows queue values as negatives
(no marker) socket present in both — shows Recv-Q and Send-Q as deltas
(after minus before), so zero means no change

Example output:

State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 0 0.0.0.0:ssh 0.0.0.0:*
[+] LISTEN 0 511 0.0.0.0:http 0.0.0.0:*
[-] LISTEN 0 5 0.0.0.0:9000 0.0.0.0:*

Key functions in ss-lt-diff.py:

parse_ss_output(filename)
Reads an ss -lt file, skips the header, and returns an OrderedDict keyed
by (local_addr, local_port, peer_addr, peer_port). Handles both IPv4 and
IPv6 addresses (rsplit on last colon).

format_socket_line(marker, socket_info)
Formats a single output row with fixed column widths to match ss layout.

compare_sockets(file1, file2)
Builds the union of socket keys from both files, sorts for consistent
output, computes integer deltas for Recv-Q and Send-Q on unchanged
sockets, and prints the full report with the header.

main()
Validates argument count and calls compare_sockets(). Exits non-zero
with a usage message if called with wrong arguments.