I ran tcpdump
on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections.
I used:
while true; do ss -ntap '{ dport :8086 }'; sleep 0.1; done
however, I don't see anything show up even when tcpdump captured outgoing requests to that port.
I tried using auditd to capture them at the kernel level, as I thought ss
may not be capturing these small requests.
I used: auditctl -A exit,always -F arch=x86_64 -S connect -S sendmsg -S sendto -k send
and used ausearch -k send -i
to look for these requests, but again, no avail.
I'm wondering how could it possible that TCP connections are made to an external host while not captured by auditd?
Thanks in advance!