I'm having problems with my server, and have been using
iftop to show connections to and from the server in real time.
It shows an IP address that is constantly connected to/from me, but I can't find any information about what it is used for.
How can I find out what exactly that ip is doing with my server?
EDIT: with help of the answers, I was able to see with iftop the following
my.ip.address:46414 => 22.214.171.124:https
Then with netstat -a I see the following
tcp 0 0 my.ip.address:46414 126.96.36.199:https ESTABLISHED
I do have an apache web server, but that IP is not showing on the logs. And furthermore, why is it connecting to port 46414?? What is he doing!
EDIT2: Ok, thanks to the answer of Daniel t. I'm getting closer. I tried with lsof -i:46475 and this is the output
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME apache2 22003 www-data 19u IPv4 716074 0t0 TCP ns.arg2.wirall.com:46475
So it looks like apache is doing something... but as it is an outbound connection, how can I know what is it really doing??
pstreeand you can see what it is doing at the system call level with