I have a program that tries to connect to a server on start-up on a unknown port. I need to find out which port the program accesses to enable a ssh tunnel.

I tried netstat but since the connection fails I don't find any useful information.

strace -e trace=connect -f yourprogram

or using a dump file

strace -o yourprogram.strace -e trace=connect -f yourprogram

Just another option: the auditd of Linux support system call logging.

sudo auditctl -a entry,always -F arch=b64 -S connect

Something better compare to strace: you can filter by multiple condition.

For example:

  • Audit/Log all failed connect system call: sudo auditctl -a entry,always -F arch=b64 -F success!=0 -S connect
  • Audit/Log all connect system call by specific uid: sudo auditctl -a entry,always -F arch=b64 -F auid=501 -S connect

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.