20

Is there a way to log to file all the outgoing connections that a process creates? I am aware of netstat but that seems to be more of a snapshot of a point in time rather than something that runs and logs information over a period.

I only need the IP or hostname, port and the process making the connection.

12

On Linux, you can set up the audit subsystem to log every attempt to establish a network connection. For information about the audit subsystem, read the auditctl man page or this tutorial or other examples on this site. Install your distribution's auditd package if necessary, then

auditctl -A exit,always -S connect
  • 3
    I needed to identify which process was making an outgoing connection. This did it instantly. To avoid flooding the logs, remove the rule afterward: auditctl -d exit,always -S connect – Michael Hampton May 26 '13 at 3:59
5

If you're able to install a custom kernel, you should have a look at SystemTap. There are plenty of examples how to trace network activity.

3

On Linux, you can use ip_conntrack to accomplish this. It's a connection tracking module, used normally to monitor connections for oddly behaving protocols (like FTP) to be managed by a firewall/NAT box.

modprobe ip_conntrack
cat /proc/net/ip_conntrack

You can grep the pseudo-file to see established connections, and further grep the source IP to see when it originates from your box.

  • The question may not be necessarily Linux-centric. – Karlson Jan 26 '12 at 18:22
0

I would look into using tcpdump on the outbound interface looking at the outbound SYN requests.

If you feel really adventurous you could make utilities like: strace or truss report all connect system calls while tracing the execution of the program but this is a bit more dangerous and has drawbacks when dealing with multithreaded processes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.