I have several Linux (mostly Debian) servers running on a Proxmox platform. All of them connecting to Internet through an ADSL line, with only one public IP.

One of them is running OMD (open monitoring distribution) since longer than a year ago to monitor an EXTERNAL server (other network, monitored through that ADSL connecting to Internet.

Now I have received a message from the owners of the remote server saying that they have detected a port scan run in the night from my ADSL public IP scanning their open ports.

It's the second time this happens to me with a Debian system :(

I need to detect the process running that scan

  • how can I find out what process is launching that portscan from the offending linux box? The difficulty here is that I'd need to run -whatever- to know the process when the scan takes place -which can happen at some moment in the night-.
  • Is there a way to get a list of processes that have somehow being launched and then finished between two times (i.e. new processes started from 23:00 to 03:00)

Thanks in advance

  • 3
    Look at the auditd and acct packages. Aug 21 '15 at 10:40
  • Maybe you once set up a cron job to do that!? Or running port scans is feature of your monitoring tool (would make sense). Have you looked in the config of your monitoring tool?
    – Matthias
    Aug 21 '15 at 11:19
  • 1
    Are you sure you are doing a port scan? Monitoring network traffic during the concerning period of time would help provide verification that you are chasing a real problem.
    – chicks
    Aug 21 '15 at 13:33
  • Thanks. I'll check those two packages. I have never needed them before and didn't know them.
    – Eduardo R.
    Aug 24 '15 at 9:40
  • Yes, a port scan is being run. As said, I need advice about best way to know what process is launching them from time to time.
    – Eduardo R.
    Aug 24 '15 at 9:41

The best way to keep track of such unwanted behavior is to collect logs of your machine activity from time to time.

Running a script every 15 minutes with cron that will look at open network connexions might be the best way to go.

I would advise you to use the lsof command and collect information about the network connexion made by your machine. Something like:

lsof -i@scanned-server.domain.net >> /tmp/my-connexions.log

Or, if your machine is scanning randomly and change the IPs scanned every time you may us (restrict to TCP connexions only):

lsof  -iTCP >> /tmp/my-connexions.log

The result of an lsof command is as follow:

iceweasel 31562 user 50u IPv4 13500060   0t0  TCP bill:47039->stackoverflow.com:https (ESTABLISHED)
iceweasel 31562 user 60u IPv4 13549538   0t0  TCP bill:60564-> (ESTABLISHED)
iceweasel 31562 user 61u IPv4 13578815   0t0  TCP bill:46285-> (ESTABLISHED)
iceweasel 31562 user 67u IPv4 13496262   0t0  TCP bill:47020->stackoverflow.com:https (ESTABLISHED)

On the leftmost of each line, you can see the name of the program running the connexion (which is the interesting part in your case). The rest of the line describe the connexion and the protocol used.

You may also look at auditctl (comes with the auditd package) that will log any system call of a program to the kernel (which is much more precise that running an lsof from time to time). You can run something like (read the documentation first, as always!):

auditctl -A exit,always -S connect
  • Thanks. Using lsof in crontab makes difficult to find the offending process, because it seems that should match exactly the moment the scanning process is running. auditctl seems to fit better what I need. I'll read the doc for it and investigate further.
    – Eduardo R.
    Aug 24 '15 at 9:46
  • Yes, I agree with you. It would be unlikely to run lsof just at the time a scan is performed. Yet, lsof is something extremely useful when you know that something is going on while you are on your machine.
    – perror
    Aug 24 '15 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.