Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to log to file all the outgoing connections that a process creates? I am aware of netstat but that seems to be more of a snapshot of a point in time rather than something that runs and logs information over a period.

I only need the IP or hostname, port and the process making the connection.

share|improve this question
Well, you could do something like watch -n 2 netstat in the meantime, but that's not a proper solution, is it. – Ulrich Schwarz Jan 26 '12 at 11:22
[This thread][1] should answer your question [1]: superuser.com/questions/34782/… – Alien Life Form Jan 26 '12 at 12:42
See also How to find out which file is currently written by a process for file accesses – Gilles Feb 12 '12 at 12:43

On Linux, you can set up the audit subsystem to log every attempt to establish a network connection. For information about the audit subsystem, read the auditctl man page or this tutorial or other examples on this site. Install your distribution's auditd package if necessary, then

auditctl -A exit,always -S connect
share|improve this answer
I needed to identify which process was making an outgoing connection. This did it instantly. To avoid flooding the logs, remove the rule afterward: auditctl -d exit,always -S connect – Michael Hampton May 26 '13 at 3:59

If you're able to install a custom kernel, you should have a look at SystemTap. There are plenty of examples how to trace network activity.

share|improve this answer

On Linux, you can use ip_conntrack to accomplish this. It's a connection tracking module, used normally to monitor connections for oddly behaving protocols (like FTP) to be managed by a firewall/NAT box.

modprobe ip_conntrack
cat /proc/net/ip_conntrack

You can grep the pseudo-file to see established connections, and further grep the source IP to see when it originates from your box.

share|improve this answer
The question may not be necessarily Linux-centric. – Karlson Jan 26 '12 at 18:22

I would look into using tcpdump on the outbound interface looking at the outbound SYN requests.

If you feel really adventurous you could make utilities like: strace or truss report all connect system calls while tracing the execution of the program but this is a bit more dangerous and has drawbacks when dealing with multithreaded processes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.