Detecting which application is using which network interface

Question

Is it possible to see which application is using which network interface?

For instance, if I have a wifi connection and a LAN cable, is there a way to get a clear answer "skype: eth0" or "google chrome: wlan0" ?

Answer 1

I think , you should just capture the packets using wire-shark or tcpdump and see which application is using which ip ( and hence interface) for communication by looking at the addresses.

Update1

You can grab the process ids by pgrep command and then use this command:

   lsof -Pan -p PID -i

Example:

pgrep firefox
23533

lsof -Pan -p 23533 -i
 COMMAND   PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
 firefox 23533 iahmad   73u  IPv4 1317376      0t0  TCP   137.138.52.207:59237->104.16.116.182:80 (ESTABLISHED)
 firefox 23533 iahmad   74u  IPv4 1317600      0t0  TCP 137.138.52.207:46223->66.220.158.19:443 (ESTABLISHED)
 firefox 23533 iahmad   75u  IPv4 1316597      0t0  TCP 137.138.52.207:32950->198.252.206.25:443 (ESTABLISHED)
 firefox 23533 iahmad   79u  IPv4 1317730      0t0  TCP 137.138.52.207:32989->198.252.206.25:443 (ESTABLISHED)
 firefox 23533 iahmad   80u  IPv4 1317759      0t0  TCP 137.138.52.207:45125->31.13.71.7:443 (ESTABLISHED)

so 137.138.52.207 is my eth0 if i do ip a s command. There firefox is using eth0.

For skype:

   pgrep skype
   24611

and then do:

   lsof -Pan -p 24611 -i

will show the interface for skype as well.

Answer 2

Some of us are very cautious about using tcpdump during working hours. It could add 25% additional processing time to each packet received, as shown by strace(1), so on a busy system utilizing it during the hours when it may be the most handy is not really an option (people complain when network processing times increase by 25% on an interface experiencing high traffic flow). So, tcpdump may be out.

Steps to take when tcpdump is not an option:

First, take a look at your interfaces. See which ones might have high throughput:

human=-h  # Make this empty if you want full output: human=""

{ echo . interface . \\ bytes pkts err drop ovrrun mcast \\ . \\ bytes pkts err drop carr collsn ; ip -o -s $human link show | sed -e 's/<.* RX:/RX:/' -e 's/bytes.*mcast//' -e 's/bytes.*collsns//' -e 's/\\  *altname.*//' -e 's/  *$//'; } | column -t

That will show you the amount of network packets and bytes through each interface since last system reboot. Output will look something like this:

.    interface         .    \  bytes  pkts   err   drop   ovrrun  mcast  \  .    \  bytes  pkts   err  drop  carr  collsn
1:   lo:               RX:  \  119G   366M   0     0      0       0      \  TX:  \  119G   366M   0    0     0     0
2:   em1:              RX:  \  1.30T  1.59G  0     30.4k  0       613M   \  TX:  \  900G   846M   0    0     0     0
3:   p1p1:             RX:  \  23.8G  176M   0     15.3k  0       153M   \  TX:  \  80.5M  698k   0    0     0     0

Show a nice display of your ip addresses:

/usr/sbin/ip -o -4 a | sed -e 's/^.*: //' -e '/host lo/d' -e 's/ brd .*//' -e 's/ inet //' | sort | column -t

This will give you output like this:

em1        10.172.10.44/23
p1p1       10.173.43.190/24

Next, on the interfaces with high utilization (we'll assume we're interested in p1p1 in this scenario), do this:

ss -tulpn | grep 10.173.43.190

This will give you output like this, and show connecting and listening processes on that interface:

udp    UNCONN     0      0      10.173.43.190:28003                 *:*                   users:(("Main",pid=235446,fd=51))
tcp    LISTEN     0      5      10.173.43.190:21000                 *:*                   users:(("httpd",pid=54079,fd=17))

Your process pid's are displayed there.

You can also find multicast listeners (ipv4-based example given because of the "dev inet" option):

ip -o maddr show dev inet | grep p1p1

Gives an output like this:

8:      p1p1\   inet  239.164.10.1

And then you can check your ss -tulpn | grep 239.164 command output, as per the above. However, there are caveats- see https://stackoverflow.com/questions/15892675/listing-multicast-sockets Specifically: "a multicast socket is not bound to an address, it only participates in a multicast group (IP_ADD_MEMBERSHIP). A socket can join multiple different groups on the same interface, or same group on different interfaces"

I have seen pid's show up in that ss output, but I've also seen some multicast groups missing in that output. I'm not sure why the multicast would show up in ip -o maddr show but not in ss, it may have something to do with applications using kernel bypass (just a guess).