I have several problems:

  1. some process is attempting to send data and the firewall is rejecting it at the rate it is sending it out
  2. firewall logs flood the system (may need to rate-limit the logging)
  3. lsof -i :port does not list the process, but there has to be something causing the packets to keep being sent. netstat -patune lists it in the SYN_SENT state not listening

The port that it is using does not make sense to me so that is one oddity and the other being how traffic continues to be sent.

  • If you have nethog installed does it show the egressing traffic? – slm Mar 9 '14 at 2:46
  • 1
    Make up your mind: Either the process is sending (SYN) data or it is listening on a port (then it would be receiving data and easily be seen with netstat). Probably the question title is wrong. – Hauke Laging Mar 9 '14 at 2:46
  • exactly what rule is triggered in the firewall? – Braiam Mar 9 '14 at 2:47
  • For example: sudo nethogs wlp3s0 to listen on my wifi. – slm Mar 9 '14 at 2:47
  • Next strange point: netstat -patune does show the process. Even in SYN_SENT state. – Hauke Laging Mar 9 '14 at 2:51

To check which programs is listening on a port.

The command netstat has options to show listened ports and programs/pids, I usually disable DNS look up as well.

netstat -nlp

or just tcp ports

netstat -nltp

man netstat for further reading and all options.


I couldn't resolve what was trying to connect, but what killed whatever process was trying to connect was simply ifconfig interface_name down.

  • Actually, it appears to have been something from my NFS server. I never had this problem before, but I'm on a different linux distribution so perhaps the difference in configuration is coming into play. – Walter Mar 22 '14 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.