I have a program that tries to connect to a server on start-up on a unknown port. I need to find out which port the program accesses to enable a ssh tunnel.
netstat but since the connection fails I don't find any useful information.
strace -e trace=connect -f yourprogram
or using a dump file
strace -o yourprogram.strace -e trace=connect -f yourprogram
Just another option: the
auditd of Linux support system call logging.
sudo auditctl -a entry,always -F arch=b64 -S connect
Something better compare to
strace: you can filter by multiple condition.
sudo auditctl -a entry,always -F arch=b64 -F success!=0 -S connect
connectsystem call by specific uid:
sudo auditctl -a entry,always -F arch=b64 -F auid=501 -S connect