3

I am examining the egress IPTABLES log of my computer for yesterday and notice the following:

IN= OUT=eth0 SRC=192.168.1.1 DST=69.46.36.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP SPT=56789 DPT=4000 WINDOW=29200 RES=0x00 SYN URGP=0

After looking up the list of well known TCP ports, there is only a Diablo II game using port 4000. I don't have the game installed on my computer. I tried but could not determine what other services could be connecting to the port.

As this only happen yesterday, if I use netstat, I could be staring at the screen the entire day to catch the service in action. Is there a better way to determine what program or user connected to this particular port?

  • You might want to use whois or dig/host to map the destination IP to a company or domain to figure out what you are connecting to. – MattBianco Sep 2 '14 at 12:26
5

You can use the audit system to log all connect() system calls.

sudo auditctl -a exit,always -F arch=b64 -S connect -k connectLog
sudo auditctl -a exit,always -F arch=b32 -S connect -k connectLog

Then you can search:

sudo ausearch -i -k connectLog -w --host 69.46.36.10

Which will show something like:

type=SOCKADDR msg=audit(02/09/14 12:31:57.966:60482) : saddr=inet host:69.46.36.10 serv:4000
type=SYSCALL msg=audit(02/09/14 12:31:57.966:60482) : arch=x86_64 syscall=connect success=no exit=-4(Interrupted system call) a0=0x3 a1=0x20384b0 a2=0x10 a3=0x7fffbf8c9540 items=0 ppid=21712 pid=25423 auid=stephane uid=stephane gid=stephane euid=stephane suid=stephane fsuid=stephane egid=stephane sgid=stephane fsgid=stephane tty=pts5 ses=4 comm=telnet exe=/usr/bin/telnet.netkit key=connect

BTW, I've seen that IP address being resolved from grm.feedjit.com and connection attempts being done to that on 400x ports by iPhones.

  • Thank you. I tried to use your method, but so far it hasn't happen again. From the hostname, I suspect it might be triggered by a browser visit to a wordpress site that has installed a plugin created by feedjit. As a side note, I wonder whether I should block egress traffic to non-conventional ports such as this one. – Question Overflow Sep 2 '14 at 14:10
0

Use grep with netstat for a particular port. For checking infinite period of time with a time delay you can use the follwoing command --

while($1); do netstat -anp | grep :80; sleep 1s;done > output.txt
  • This answer assumes that it is a process in the OP's computer that is involved in the communication, and what about PIDs and IP-addresses that contain the string "80"? I think (e)grepping also for "ESTABLISHED" would keep the output a bit cleaner. – MattBianco Sep 2 '14 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.