last time i watched out my iptables-log and i dont know , how i get the reason or which process ordered the connection establishment.

Jan  8 23:02:17 ipo-dara kernel: [49323.868478] iptables-dropped: IN= OUT=eno1 SRC=myserver.ip DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=35516 DF PROTO=TCP SPT=36764 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0

Here we see a dropped output connection from src to dst-ip to port 443, i dont now why ? How can i find the reason, why my server want to connect to ???

a short introduction would help me a lot.

kind regards blackbeard

  • You can't get that information from the iptables logs.
    – Zoredache
    Jan 8, 2020 at 23:23
  • and where can i read the reason ? some examble Jan 8, 2020 at 23:52
  • You will need to track down the source port. Look into netstat and lsof. That will tell you which application/service is using that port. Then find more information from the log of that service. Jan 9, 2020 at 8:45
  • This Q/A could also help: How I can identify which process is making UDP traffic on Linux? (except it's SOCK_STREAM for TCP rather than SOCK_DGRAM)
    – A.B
    Jan 9, 2020 at 16:19
  • i installed nestat and lsof but i couldnt find the dynamic (privat) port 36764 for tcp. nestat showes me only the open/listen port Jan 9, 2020 at 20:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy