I am examining the egress IPTABLES log of my computer for yesterday and notice the following:

IN= OUT=eth0 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP SPT=56789 DPT=4000 WINDOW=29200 RES=0x00 SYN URGP=0

After looking up the list of well known TCP ports, there is only a Diablo II game using port 4000. I don't have the game installed on my computer. I tried but could not determine what other services could be connecting to the port.

As this only happen yesterday, if I use netstat, I could be staring at the screen the entire day to catch the service in action. Is there a better way to determine what program or user connected to this particular port?

  • You might want to use whois or dig/host to map the destination IP to a company or domain to figure out what you are connecting to.
    – MattBianco
    Sep 2, 2014 at 12:26

2 Answers 2


You can use the audit system to log all connect() system calls.

sudo auditctl -a exit,always -F arch=b64 -S connect -k connectLog
sudo auditctl -a exit,always -F arch=b32 -S connect -k connectLog

Then you can search:

sudo ausearch -i -k connectLog -w --host

Which will show something like:

type=SOCKADDR msg=audit(02/09/14 12:31:57.966:60482) : saddr=inet host: serv:4000
type=SYSCALL msg=audit(02/09/14 12:31:57.966:60482) : arch=x86_64 syscall=connect success=no exit=-4(Interrupted system call) a0=0x3 a1=0x20384b0 a2=0x10 a3=0x7fffbf8c9540 items=0 ppid=21712 pid=25423 auid=stephane uid=stephane gid=stephane euid=stephane suid=stephane fsuid=stephane egid=stephane sgid=stephane fsgid=stephane tty=pts5 ses=4 comm=telnet exe=/usr/bin/telnet.netkit key=connect

BTW, I've seen that IP address being resolved from grm.feedjit.com and connection attempts being done to that on 400x ports by iPhones.

  • Thank you. I tried to use your method, but so far it hasn't happen again. From the hostname, I suspect it might be triggered by a browser visit to a wordpress site that has installed a plugin created by feedjit. As a side note, I wonder whether I should block egress traffic to non-conventional ports such as this one. Sep 2, 2014 at 14:10

Use grep with netstat for a particular port. For checking infinite period of time with a time delay you can use the follwoing command --

while($1); do netstat -anp | grep :80; sleep 1s;done > output.txt
  • This answer assumes that it is a process in the OP's computer that is involved in the communication, and what about PIDs and IP-addresses that contain the string "80"? I think (e)grepping also for "ESTABLISHED" would keep the output a bit cleaner.
    – MattBianco
    Sep 2, 2014 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .