Given an external IP address and target port, in Linux, is there any way to use something like ngrep or tcpdump to identify the process and/or user that is sometimes sending traffic to it? Or iptables rules? Is there a recommended way to run an ongoing monitor that's not too resource intensive?

2 Answers 2


Knowing the IP and port, you can use netstat to find out which process/user is associated with the connection by using a few parameters: netstat -tunp

# netstat -tunp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0     36          ESTABLISHED 4060/sshd: ralloway 

The -t option turns on TCP. The -u option turns on UDP. The -n option turns on numeric printing of hosts, ports, etc. The -p option turns on printing the PID and name of the program.

The ss utility is a newer replacement for netstat and, in this case, the same options return the same info:

# ss -tunp
Netid State      Recv-Q Send-Q  Local Address:Port   Peer Address:Port              
tcp   ESTAB      0      0               users:(("sshd",pid=4062,fd=3),("sshd",pid=4060,fd=3))

I'm don't know of any ongoing monitors, off the top of my head, but you could check out the options for iftop, nettop, nethogs, etc to see if they'll fit your needs.

-Rich Alloway (RogueWave)

  • It's not an ongoing connection. It's intermittent traffic. But thank you.
    – chell
    Feb 10, 2017 at 3:35
  • @chell Give nethogs a try. It'll show you the PIDs and owners of the processes, the program name, network device used, and tx/rx data rate or cumulative amount continuously. Feb 10, 2017 at 19:13
  • I read about it but it looked like it runs in a window I'd have to watch. I need something I can leave running and come back to see results later. I'll take another look to see if it has other modes of operation (or do you know?)
    – chell
    Feb 11, 2017 at 16:29
  • @chell nethogs has a trace mode that just outputs data to the console. You could redirect that output to a file. Feb 13, 2017 at 15:57

Rich Alloway - RogueWave's answer had some promising suggestions, but each package falls short in one way or another. The only option I could find that satisfied all my needs was sysdig

There's many ways to use it, such as:

sysdig -p "*%evt.num %evt.datetime %evt.cpu (%user.name) %proc.name (%thread.tid) %evt.dir %evt.type %evt.info" '(fd.rnet= or fd.rnet= and fd.rport=443' | tee outputfile

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.