Given an external IP address and target port, in Linux, is there any way to use something like ngrep
or tcpdump
to identify the process and/or user that is sometimes sending traffic to it? Or iptables
rules? Is there a recommended way to run an ongoing monitor that's not too resource intensive?
2 Answers
Knowing the IP and port, you can use netstat
to find out which process/user is associated with the connection by using a few parameters: netstat -tunp
# netstat -tunp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 36 192.168.42.253:22 10.0.0.7:51313 ESTABLISHED 4060/sshd: ralloway
The -t
option turns on TCP.
The -u
option turns on UDP.
The -n
option turns on numeric printing of hosts, ports, etc.
The -p
option turns on printing the PID and name of the program.
The ss
utility is a newer replacement for netstat
and, in this case, the same options return the same info:
# ss -tunp
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp ESTAB 0 0 192.168.42.253:22 10.0.0.7:51313 users:(("sshd",pid=4062,fd=3),("sshd",pid=4060,fd=3))
I'm don't know of any ongoing monitors, off the top of my head, but you could check out the options for iftop, nettop, nethogs, etc to see if they'll fit your needs.
-Rich Alloway (RogueWave)
-
It's not an ongoing connection. It's intermittent traffic. But thank you.– chellFeb 10, 2017 at 3:35
-
@chell Give nethogs a try. It'll show you the PIDs and owners of the processes, the program name, network device used, and tx/rx data rate or cumulative amount continuously. Feb 10, 2017 at 19:13
-
I read about it but it looked like it runs in a window I'd have to watch. I need something I can leave running and come back to see results later. I'll take another look to see if it has other modes of operation (or do you know?)– chellFeb 11, 2017 at 16:29
-
@chell nethogs has a trace mode that just outputs data to the console. You could redirect that output to a file. Feb 13, 2017 at 15:57
Rich Alloway - RogueWave's answer had some promising suggestions, but each package falls short in one way or another. The only option I could find that satisfied all my needs was sysdig
There's many ways to use it, such as:
sysdig -p "*%evt.num %evt.datetime %evt.cpu (%user.name) %proc.name (%thread.tid) %evt.dir %evt.type %evt.info" '(fd.rnet=1.2.0.0/16 or fd.rnet=3.4.5.0/24) and fd.rport=443' | tee outputfile