1

Given an external IP address and target port, in Linux, is there any way to use something like ngrep or tcpdump to identify the process and/or user that is sometimes sending traffic to it? Or iptables rules? Is there a recommended way to run an ongoing monitor that's not too resource intensive?

2 Answers 2

1

Knowing the IP and port, you can use netstat to find out which process/user is associated with the connection by using a few parameters: netstat -tunp

# netstat -tunp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0     36 192.168.42.253:22       10.0.0.7:51313          ESTABLISHED 4060/sshd: ralloway 

The -t option turns on TCP. The -u option turns on UDP. The -n option turns on numeric printing of hosts, ports, etc. The -p option turns on printing the PID and name of the program.

The ss utility is a newer replacement for netstat and, in this case, the same options return the same info:

# ss -tunp
Netid State      Recv-Q Send-Q  Local Address:Port   Peer Address:Port              
tcp   ESTAB      0      0       192.168.42.253:22    10.0.0.7:51313               users:(("sshd",pid=4062,fd=3),("sshd",pid=4060,fd=3))

I'm don't know of any ongoing monitors, off the top of my head, but you could check out the options for iftop, nettop, nethogs, etc to see if they'll fit your needs.

-Rich Alloway (RogueWave)

4
  • It's not an ongoing connection. It's intermittent traffic. But thank you.
    – chell
    Feb 10, 2017 at 3:35
  • @chell Give nethogs a try. It'll show you the PIDs and owners of the processes, the program name, network device used, and tx/rx data rate or cumulative amount continuously. Feb 10, 2017 at 19:13
  • I read about it but it looked like it runs in a window I'd have to watch. I need something I can leave running and come back to see results later. I'll take another look to see if it has other modes of operation (or do you know?)
    – chell
    Feb 11, 2017 at 16:29
  • @chell nethogs has a trace mode that just outputs data to the console. You could redirect that output to a file. Feb 13, 2017 at 15:57
1

Rich Alloway - RogueWave's answer had some promising suggestions, but each package falls short in one way or another. The only option I could find that satisfied all my needs was sysdig

There's many ways to use it, such as:

sysdig -p "*%evt.num %evt.datetime %evt.cpu (%user.name) %proc.name (%thread.tid) %evt.dir %evt.type %evt.info" '(fd.rnet=1.2.0.0/16 or fd.rnet=3.4.5.0/24) and fd.rport=443' | tee outputfile

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .