49

Is there a way to show the connections of a process? Something like that:

show PID

in which show is a command to do this, and PID is the ID of the process. The output that I want is composed of all the connections of the process (in real-time). For example, if the process tries to connect to 173.194.112.151 the output is 173.194.112.151.

A more specific example with Firefox:

show `pidof firefox`

and with Firefox I go at first to google.com, then to unix.stackexchange.com and finally to 192.30.252.129. The output, when I close the browser, must be:

google.com
stackexchange.com
192.30.252.129

(Obviously with the browser this output is not realistic, because there are a lot of other related connections, but this is only an example.)

4

4 Answers 4

49

You're looking for strace! I found this answer on askubuntu, but it's valid for Unix:

To start and monitor an new process:

strace -f -e trace=network -s 10000 PROCESS ARGUMENTS

To monitor an existing process with a known PID:

strace -p $PID -f -e trace=network -s 10000

Otherwise, but that's specific to Linux, you can run the process in an isolated network namespace and use wireshark to monitor the traffic. This will probably be more convenient than reading the strace log:

  • create a test network namespace:

    ip netns add test
    
  • create a pair of virtual network interfaces (veth-a and veth-b):

    ip link add veth-a type veth peer name veth-b
    
  • change the active namespace of the veth-a interface:

    ip link set veth-a netns test
    
  • configure the IP addresses of the virtual interfaces:

    ip netns exec test ifconfig veth-a up 192.168.163.1 netmask 255.255.255.0
    ifconfig veth-b up 192.168.163.254 netmask 255.255.255.0
    
  • configure the routing in the test namespace:

    ip netns exec test route add default gw 192.168.163.254 dev veth-a
    
  • activate ip_forward and establish a NAT rule to forward the traffic coming in from the namespace you created (you have to adjust the network interface and SNAT ip address):

    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -s 192.168.163.0/24 -o YOURNETWORKINTERFACE -j SNAT --to-source YOURIPADDRESS
    

    (You can also use the MASQUERADE rule if you prefer)

  • finally, you can run the process you want to analyze in the new namespace, and wireshark too:

    ip netns exec test thebinarytotest
    ip netns exec test wireshark
    

    You'll have to monitor the veth-a interface.

2
  • 4
    strace is actually specific to the Linux kernel, so it’s not valid for all Unix-like operating systems. As I understand it, BSD-like systems have similar utilities (DTrace and truss). Anyhow, good answer (so upvoted). Welcome to Stack Exchange. Commented Jan 19, 2017 at 14:17
  • The answer seems to point into the right direction, however I'm having problems interpreting the strace output while examining git fetch. I was expecting to see some sort of URL included in the output, as also requested by the OP. Can someone help?
    – andreee
    Commented Jul 5, 2019 at 7:37
34

Try

lsof -i -a -p $(pidof firefox | sed 's/ /,/g')

From pidof man page:

Description
Pidof finds the process id's (pids) of the named programs.
It prints those id's on the standard output.

From lsof man page:

  • -i This option selects the listing of files any of whose Internet address matches the address specified in i. If no address is specified, this option selects the listing of all Internet and x.25 (HP-UX) network files.
  • -a AND
  • -p This option excludes or selects the listing of files for the processes whose optional Process IDentification (PID) numbers are in the comma-separated set s - e.g., 123 or 123,^456. (There should be no spaces in the set.)

Why sed : When we have Multiple Processes matching the Process Name & we want that PID list from pidof to go to lsof which wants comma after each PID , we have to convert the spaces to commas. We can alternatively use tr \ \, too.
When we know we have Exactly Single Process with the given Process Name , we can skip sed & tr.

6
  • It partially works: it prints some of the current connections of the process, but then it closes automatically. For some programs the output is only this warning: lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /home/user/.gvfs Output information may be incomplete.
    – ᴜsᴇʀ
    Commented Oct 2, 2015 at 14:14
  • You may add options -r1 to repeat output every second and -w to suppress warnings.
    – alxrem
    Commented Oct 2, 2015 at 14:38
  • 2
    This only shows connections at a point in time, it doesn't list all the connections a process makes over its lifetime. Even if you put this command in a loop, it'll miss short-lived connections. Commented Oct 2, 2015 at 22:23
  • The questioner didn't ask to view the connections over it's lifetime. One could interpret (in real-time) as from the point in time of tracking and forward.
    – llua
    Commented Oct 3, 2015 at 0:26
  • 1
    @reinierpost I would have thought tr \ , to be simpler. Commented May 19, 2023 at 15:04
14

Here's another approach:

ss -nap | grep $(pidof firefox)

Sample output:

tcp    ESTAB      0      0          192.168.0.222:49050    216.58.218.164:443    users:(("firefox",3280,69))
tcp    ESTAB      0      0          192.168.0.222:48630    198.252.206.25:443    users:(("firefox",3280,106))
tcp    ESTAB      0      0          192.168.0.222:44220     216.58.217.38:443    users:(("firefox",3280,140))
tcp    ESTAB      0      0          192.168.0.222:52690    54.240.170.181:80     users:(("firefox",3280,107))
tcp    ESTAB      0      0          192.168.0.222:48744    198.252.206.25:443    users:(("firefox",3280,87))
tcp    ESTAB      0      0          192.168.0.222:48811    198.252.206.25:443    users:(("firefox",3280,73))
1
  • 2
    This only shows connections at a point in time, it doesn't list all the connections a process makes over its lifetime. Even if you put this command in a loop, it'll miss short-lived connections. Commented Oct 2, 2015 at 22:23
8

You can try also with netstat -p. From the man page:

netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

To show only networking connections use netstat -tup. Notice that to see the process PID you may need to be root.

If you don't have netstaton your system you may have ss, which has almost the exact syntax. You can use then ss -tup (as root).

3
  • 3
    This only shows connections at a point in time, it doesn't list all the connections a process makes over its lifetime. Even if you put this command in a loop, it'll miss short-lived connections. Commented Oct 2, 2015 at 22:22
  • 1
    netstat -p | grep firefox | grep tcp Commented Jan 24, 2017 at 18:55
  • @Gilles Which means it is a great answer for anyone wanting to see the connections at a point in time. As was my case recently. Commented Jan 24, 2019 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .