I would like to have a tcpdump like program that shows which program sent a specific packet, instead of just getting the port number. This is a generic problem I've had on and off sometimes when you have and old tcpdump file lying around you have no way to find what program was sending that data..
The solution in how i can identify which process is making UDP traffic on linux ? is an indication that I can solve this with auditd, dTrace, OProfile or SystemTap, but doesn't show how to do it. I.e. it doesn't show the source port of the program calling bind()..
The problem I had was strange UDP packets, and since those ports are so short lived it took me a while to solve this issue. I solved this by running an ugly hack similar to:
while true; date +%s.%N;netstat -panut;done
So either a method better than this hack, a replacement for tcpdump, or some way to get this info from the kernel so I can patch tcpdump.
Solving this with auditd
sudo auditctl -a exit,always -F arch=b64 -S bind -k BIND
This fills /var/log/audit/audit.log with lines like:
type=SYSCALL msg=audit(1292929028.845:3377): arch=c000003e syscall=49 success=yes exit=0 a0=3 a1=808710 a2=10 a3=7fffab28ea10 items=0 ppid=1564 pid=24442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4294967295 comm="nc" exe="/bin/nc.openbsd" key="BIND"
type=SOCKADDR msg=audit(1292929028.845:3377): saddr=0200FFFF000000000000000000000000
Then parse the saddr=0200xxxx00 where xxxx is the port number, 0001 is lowest and FFFF is highest.
EDIT: This was asked on superuser "tracking what programs sends to net", no good solution though.