Presently iptables is blocking all outbound traffic except for a few known/approved services. iptables logs a sample of each time it blocks (2/min),

I am trying to figure out what is making the requests that IPTable blocks.

Sep 17 06:30:39 [_REDACTED_] kernel: [936079.231998] iptables output drop: IN= OUT=eth0 SRC=[_REDACTED_] DST=[_REDACTED_] LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=25628 DF PROTO=TCP SPT=53657 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0

How do I figure out what is making this request?


You can use either

fuser <source_port>/tcp


netstat -anp | grep :<source_port>

which should give you the PID (and in case of netstat, also the name) of the process that's using the local TCP port.

You need to be fairly quick to catch the connection in the SYN_SENT state before it times out. You could even create a script that would parse the iptables log output and perform the lookup immediately when the connection is logged.

  • 1
    you're awsome thank you. I was thinking about doing something just like this but hoped there was already a tool. Thank you – Tchambers Sep 17 '15 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.