1

Is it possible to see which application is using which network interface?

For instance, if I have a wifi connection and a LAN cable, is there a way to get a clear answer "skype: eth0" or "google chrome: wlan0" ?

1
  • 1
    On a very high level, you want to join the outputs of ps(name to pid), netstat (pid to remote IP) and the routing information (IP to interface), but bear in mind that a program might be communication with multiple partners over several interfaces at the same time. Commented Jan 14, 2016 at 14:31

2 Answers 2

2

I think , you should just capture the packets using wire-shark or tcpdump and see which application is using which ip ( and hence interface) for communication by looking at the addresses.

Update1

You can grab the process ids by pgrep command and then use this command:

   lsof -Pan -p PID -i

Example:

pgrep firefox
23533

lsof -Pan -p 23533 -i
 COMMAND   PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
 firefox 23533 iahmad   73u  IPv4 1317376      0t0  TCP   137.138.52.207:59237->104.16.116.182:80 (ESTABLISHED)
 firefox 23533 iahmad   74u  IPv4 1317600      0t0  TCP 137.138.52.207:46223->66.220.158.19:443 (ESTABLISHED)
 firefox 23533 iahmad   75u  IPv4 1316597      0t0  TCP 137.138.52.207:32950->198.252.206.25:443 (ESTABLISHED)
 firefox 23533 iahmad   79u  IPv4 1317730      0t0  TCP 137.138.52.207:32989->198.252.206.25:443 (ESTABLISHED)
 firefox 23533 iahmad   80u  IPv4 1317759      0t0  TCP 137.138.52.207:45125->31.13.71.7:443 (ESTABLISHED)

so 137.138.52.207 is my eth0 if i do ip a s command. There firefox is using eth0.

For skype:

   pgrep skype
   24611

and then do:

   lsof -Pan -p 24611 -i

will show the interface for skype as well.

7
  • tcpdump is a good start, though do you have anything else? I ask for very specific things because of the application I wish to start writing though I can work with tcpdump if nothing else but it will make things tricky
    – TheHidden
    Commented Jan 14, 2016 at 14:30
  • Answer updated.
    – Ijaz Ahmad
    Commented Jan 14, 2016 at 14:41
  • @user1779617 If you need programmatic access, use the library that tcpdump is based on: libpcap Commented Jan 15, 2016 at 14:59
  • @Gilles I am programming my application in python, I assume this libpcap is available via ?
    – TheHidden
    Commented Jan 15, 2016 at 16:11
  • @ silverpenguin use the pypcap library , pypi.python.org/pypi/pypcap
    – Ijaz Ahmad
    Commented Jan 15, 2016 at 16:32
0

Some of us are very cautious about using tcpdump during working hours. It could add 25% additional processing time to each packet received, as shown by strace(1), so on a busy system utilizing it during the hours when it may be the most handy is not really an option (people complain when network processing times increase by 25% on an interface experiencing high traffic flow). So, tcpdump may be out.

Steps to take when tcpdump is not an option:

First, take a look at your interfaces. See which ones might have high throughput:

human=-h  # Make this empty if you want full output: human=""

{ echo . interface . \\ bytes pkts err drop ovrrun mcast \\ . \\ bytes pkts err drop carr collsn ; ip -o -s $human link show | sed -e 's/<.* RX:/RX:/' -e 's/bytes.*mcast//' -e 's/bytes.*collsns//' -e 's/\\  *altname.*//' -e 's/  *$//'; } | column -t

That will show you the amount of network packets and bytes through each interface since last system reboot. Output will look something like this:

.    interface         .    \  bytes  pkts   err   drop   ovrrun  mcast  \  .    \  bytes  pkts   err  drop  carr  collsn
1:   lo:               RX:  \  119G   366M   0     0      0       0      \  TX:  \  119G   366M   0    0     0     0
2:   em1:              RX:  \  1.30T  1.59G  0     30.4k  0       613M   \  TX:  \  900G   846M   0    0     0     0
3:   p1p1:             RX:  \  23.8G  176M   0     15.3k  0       153M   \  TX:  \  80.5M  698k   0    0     0     0

Show a nice display of your ip addresses:

/usr/sbin/ip -o -4 a | sed -e 's/^.*: //' -e '/host lo/d' -e 's/ brd .*//' -e 's/ inet //' | sort | column -t

This will give you output like this:

em1        10.172.10.44/23
p1p1       10.173.43.190/24

Next, on the interfaces with high utilization (we'll assume we're interested in p1p1 in this scenario), do this:

ss -tulpn | grep 10.173.43.190

This will give you output like this, and show connecting and listening processes on that interface:

udp    UNCONN     0      0      10.173.43.190:28003                 *:*                   users:(("Main",pid=235446,fd=51))
tcp    LISTEN     0      5      10.173.43.190:21000                 *:*                   users:(("httpd",pid=54079,fd=17))

Your process pid's are displayed there.

You can also find multicast listeners (ipv4-based example given because of the "dev inet" option):

ip -o maddr show dev inet | grep p1p1

Gives an output like this:

8:      p1p1\   inet  239.164.10.1

And then you can check your ss -tulpn | grep 239.164 command output, as per the above. However, there are caveats- see https://stackoverflow.com/questions/15892675/listing-multicast-sockets Specifically: "a multicast socket is not bound to an address, it only participates in a multicast group (IP_ADD_MEMBERSHIP). A socket can join multiple different groups on the same interface, or same group on different interfaces"

I have seen pid's show up in that ss output, but I've also seen some multicast groups missing in that output. I'm not sure why the multicast would show up in ip -o maddr show but not in ss, it may have something to do with applications using kernel bypass (just a guess).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .