Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When a process is exchanging data over network, I can think of at least the following parameters:

  • a remote host:port pair - it identifies the remote endpoint (there's also the local host:port pair, but the port is generally randomized for outgoing connections, so I don't need it)
  • is it TCP or UDP traffic
  • is it incoming or outgoing traffic

How can I log all this data for a certain process during its whole lifetime? I need this on Linux. I'm not trying to block some traffic, just to log the above details.

As I understand, a network sniffer alone won't do it, since when an IP packet is coming from outside, the sniffer has no idea about which process the packet is for (since this is another layer, the application layer IIRC).

share|improve this question
up vote 0 down vote accepted

If this is just for one process you could run the process under the control of strace and log the data. strace will show all of the system calls, and you can then postprocess all of the logs to see what your process was up to.

share|improve this answer
A complex app (like a daemon) could fork and spawn children. Also, threads are implemented in Linux as processes IIRC. Is strace smart enough to handle such edge cases correctly as well? Also, would stracing have a heavy impact on performance? I want to run an app the usual way and collect stats, so its performance better not be impacted badly by the inspecting logic (whatever would it be). – halp Nov 1 '10 at 18:02
Yes, strace can follow fork/execs. Depending on your app performance can be impacted, but there are ways to reduce the impact depending on how much detail you need. – jcollie Nov 1 '10 at 18:35

I'm not sure if this could be usefull to you, but alternatives are:

1) if you know the process ID (PID):

 $ lsof -ni4 -p <PID>
  • -n: numeric output (does not lookup host or port)
  • -i4: internet files (open sockets), ipv4

This will show you only connections initiated from you host.

2) Another way is to use iptables with LOG target and module owner (-m owner). Something like:

# iptables -A OUTPUT -m owner <USER ID> -j LOG '[ Some Tag ]'
# iptables -A INPUT -p tcp --dport <SERVICE PORT> -j LOG '[ Some Tag input ]'
# iptables -A INPUT -p udp --dport <SERVICE PORT> -j LOG '[ Some Tag input ]'

You could grep your syslog for the specified tag. This approach does not allow you to specify a process id, but if it is a daemon that only runs this service, could be what you want.

share|improve this answer
I'm rather looking for a socket wrapper library that could do some logging or for a process accounting kernel framework that can gather the data I need. – halp Nov 1 '10 at 17:46
Also, the lsof/netstat approach is inconvenient (you motivated that yourself). The iptables approach has drawbacks as well, an user can own many processes and it would work anyway for outgoing data only. Like I said, this is not the application level. – halp Nov 1 '10 at 17:49

Check out "tcpspy". It should do what you want. However, the homepage for the tool isn't currently responding, so you may have to look at it from FSF's listing or the Debian's archive.

Here's the description:

tcpspy is an administrator's tool that logs information about incoming and outgoing TCP/IP connections. It's written in C and uses no libpcap functions, unlike tcpdump.

Connections are selected for logging with rules, similarly to the filter expressions accepted by tcpdump. The following information is logged: username, local address and port, remote address and port, and, optionally, the executable filename.

At present, only the IPv4 protocol is supported.

Here's the relevant links:

And here's the URL listed in the Debian package as the project's homepage:

share|improve this answer
Seems to be abandonware. Vanilla source without debian patches compiles on my Slackware 13.1, but when running it I see segfault reports related to it in syslog. It also seems to watch for TCP traffic only, while I need UDP too (but hey, it doesn't seem to work for me anyway, since it is segfaulting). – halp Nov 1 '10 at 23:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.