An application contacts an Internet host on each start of it. It seems to take just an instant. I don't know if it is HTTP, plain TCP or UDP or what is used but tend to suppose HTTP. What tool can I use to track this connection?


Have a look at wireshark.


Watch all network traffic

In a terminal, as root, run


and watch the packets fly. If you have other network activity, filter that out. For example, to show everything except incoming and outgoing SSH traffic:

tcpdump not port 22

Watch what the application is doing

Run strace -o myapp.strace myapp. This writes a log of every system call that the application performs to myapp.strace. Look for lines that begin with connect(; these are the application opening a TCP or UDP connection. The target IP address and port are on that line. The protocol is determined by the previous socket call which comes before and is usually very close. Traffic to port 53 is DNS traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.