I am examining the egress IPTABLES log of my computer for yesterday and notice the following:
IN= OUT=eth0 SRC=192.168.1.1 DST=18.104.22.168 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP SPT=56789 DPT=4000 WINDOW=29200 RES=0x00 SYN URGP=0
After looking up the list of well known TCP ports, there is only a Diablo II game using port 4000. I don't have the game installed on my computer. I tried but could not determine what other services could be connecting to the port.
As this only happen yesterday, if I use
netstat, I could be staring at the screen the entire day to catch the service in action. Is there a better way to determine what program or user connected to this particular port?