When a process is exchanging data over network, I can think of at least the following parameters:
- a remote host:port pair - it identifies the remote endpoint (there's also the local host:port pair, but the port is generally randomized for outgoing connections, so I don't need it)
- is it TCP or UDP traffic
- is it incoming or outgoing traffic
How can I log all this data for a certain process during its whole lifetime? I need this on Linux. I'm not trying to block some traffic, just to log the above details.
As I understand, a network sniffer alone won't do it, since when an IP packet is coming from outside, the sniffer has no idea about which process the packet is for (since this is another layer, the application layer IIRC).