How can I find which process sends data to a specific port?

Question

I have a service, keeping a certain port open.

I'm getting data to it, that I neither expect nor want to get, and I'm trying to pin-point the source of this data. So how can I find which process that sends data to a specific port, as opposed to which process is listening.

Answer 1

For TCP (though the same approach would work for SCTP or any connection-oriented transport protocol), same as for looking for listening one

lsof -nPi tcp:the-port

Will report the processes that have a TCP socket open on that port. If you know the source port (your server application can know about it and log it), you can use that instead to pinpoint the rogue client.

For UDP or RAW sockets, it would be trickier though I suppose it's where something like systemtap or dtrace can come handy. Possibly auditd as well.

Answer 2

You may use sockstat command to find the process which has initiated connection to your service on the local host.

DESCRIPTION
     The sockstat command lists open Internet or UNIX domain sockets.

Just match all source connections to your destination. This works fine for TCP/UDP/UNIXsockets.

Answer 3

Depending on the type of connection it establishes to send data one of these approaches will get you somewhere.

• Use tcpdump port 1234 to acquire the data being sent to this port. You can use a program like Wireshark to analyze it on another machine (captured to a file using the -w option). Alternatively, use Wireshark directly.

• In case it establishes and keeps open a tcp/udp connection you could use netstat to find the remote IP of the connection.

• List open sockets of a process as in the answer provided by @StephaneChazelas.

Answer 4

On Solaris, running pfiles on all processes should show which processes have which connections open. It will require some careful filering, probably using ggrep's -A, -B options...

On Linux, netstat -anp --inet will work, even without lsof installed. (drop the --inet to get Unix domain sockets as well)