3

Is there a way to find what process is using a given network interface? The title of a related question on here is a bit too specific for my needs.

I need to confirm whether my process is running on the intended network interface.

I am using Scientific Linux 6.

2
  • The sockets of a process can be viewed in /proc/<pid>/fd, this should lead to the interfacea. – ott-- Oct 6 '16 at 16:52
  • 2
    A simple command is ss -ntp for TCP and ss -unp for UDP ports. – MariusMatutiae Oct 6 '16 at 17:16
2

Using netstat and grep you can see what programs are actively using a particular interface (not listening)

Here's what I'd use :

sudo netstat -tunape | grep "\(192.168.0.20\)" | grep ESTABLISHED

This will output all the programs and their PIDs that use the interface 192.168.0.20.

1

If you know the name of the interface in question you can use that name and look among your processes under /proc. We recently ran into an issue where we needed to find which VM (qemu) processes were using a specific network interface.

The interface in question was called enp98s0.134. That numeric suffix .134 is the VLAN being used for this interface.

$ ip a l enp98s0.134
72: enp98s0.134@enp98s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master storage state UP group default qlen 1000
    link/ether 00:25:34:12:a1:7f brd ff:ff:ff:ff:ff:ff

To find which processes were using this we merely looked through the /proc to find which QEMU processes were referencing it.

$ for i in $(pgrep qemu); do find /proc/$i -type f | grep enp98s0.134$;done | head
/proc/24217/task/24217/net/vlan/enp98s0.134
/proc/24217/task/24217/net/dev_snmp6/enp98s0.134
/proc/24217/task/24221/net/vlan/enp98s0.134
/proc/24217/task/24221/net/dev_snmp6/enp98s0.134
/proc/24217/task/24222/net/vlan/enp98s0.134
/proc/24217/task/24222/net/dev_snmp6/enp98s0.134
/proc/24217/task/24226/net/vlan/enp98s0.134
/proc/24217/task/24226/net/dev_snmp6/enp98s0.134
/proc/24217/task/24227/net/vlan/enp98s0.134
/proc/24217/task/24227/net/dev_snmp6/enp98s0.134

The 2nd digit in the path is the PID of the QEMU processes. A similar approach can be used if you happen to not know which process at all:

$ find /proc/* -type f | grep enp98s0.134$ | head
/proc/1/task/1/net/vlan/enp98s0.134
/proc/1/task/1/net/dev_snmp6/enp98s0.134
/proc/1/net/vlan/enp98s0.134
/proc/1/net/dev_snmp6/enp98s0.134
/proc/10/task/10/net/vlan/enp98s0.134
/proc/10/task/10/net/dev_snmp6/enp98s0.134
/proc/10/net/vlan/enp98s0.134
/proc/10/net/dev_snmp6/enp98s0.134
/proc/100/task/100/net/vlan/enp98s0.134
/proc/100/task/100/net/dev_snmp6/enp98s0.134

To parse out the PIDs:

$ find /proc/* -type f | grep enp98s0.134$ | awk -F/ '{print $3}' | sort -u | head -5
1
10
100
101070
104

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.