I want to be able to intercept connection establishment, e.g. want to know when some process (any process) establishes a connection. Is there a way to achieve that?

The only thing I can think of is to intercept connect() syscall. But may be there's an other way? May be when networking context is created in a kernel?

The goal is to filter processes based on some requirements and enable/disable connection establishment in real-time.

Thanks in advance.

P.S. I'm doing that for absolutely legal purposes.

P.P.S. I've searched in google but only found how to intercept the already established connection (not exactly what I want). I'm asking for an idea, a direction of search, not for a code.

  • 1
    (a) Sounds like a firewall of some sort, no idea why we'd think that's for anything other than legal purposes; (b) All connections (including, e.g., Unix-domain sockets) or just IP ones?
    – derobert
    Aug 28 '17 at 19:28
  • Don't think of it as “enable/disable connection establishment in real-time”. That's not how it works. You configure which connections should go through, and if a connection is forbidden, the process won't be able to make it. You can change the configuration at any time, but you don't decide after the process has initiated a connection, you decide before. Aug 28 '17 at 22:51
  • You might get more useful answers if you more fully describe your objectives (and maybe, to some extent, your motivations). It sounds like you want to allow some TCP connection attempts to go through and some to be blocked based on criteria that are beyond the abilities of any known firewall to configure (e.g., block attempts that are made when the clock time is a multiple of 42). Am I close?  (Please do not respond in comments; edit your question to make it clearer and more complete.)  You may need to edit the network code in the kernel.
    – Scott
    Aug 29 '17 at 5:04

For the aspect of just extracting information, it's possible to do that with iptables using AUDIT matches (or possibly LOG matches if you don't need huge amounts of info).

For the case of actually allowing or disallowing connections in real-time based on some complex rules, I'm not sure you can do that on reliably on Linux. Options include:

  • Seccomp-BPF, but I'm not certain it can do this (and the filter would be static once instantiated in a given process).
  • Overriding various socket calls using LD_PRELOAD or some other method. This is unreliable because it's easy to bypass (making direct syscalls is trivial, and you can also dlopen() whatever libc and make calls that way).
  • The net_cls control group. This requires firewall setup, may impact active connections, and may not work exactly as you want (it will require a daemon that moves processes into the appropriate control group as they are started).
  • If you can tolerate some data getting onto the network, you can use the iptables NFLOG target and watch for interesting connections (if you want real-time evaluation, you'll need to log all new connections and parse things in userspace), and then reactively close the connections that you don't want.
  • You can run each application in it's own network namespace and force outbound traffic through the host system, then use policy routing based on the source to control what gets out to the actual network.

That said, you may want to reevaluate why you need this. Unless you're feeding your decision making from a neural network or some other heuristic approach (both of which are problematic options for multiple reasons), you're almost always going to be better off either coding things directly into the firewall (iptables can do some seriously complex stuff, like matching only connections using a specific IP protocol to a specific port initiated by a particular UID at a uniformly distributed random rate and sending the unmatched packets to a different destination), or using scheduling tools or other hooks to update firewall rules dynamically (for example, changing firewall rules when the system is supposed to be unused, or only allowing new connections originating from a given UID when that user is logged in).


The goal is to filter processes based on some requirements and enable/disable connection establishment in real-time

netstat -pant |grep -i ESTABLISHED

The above command will give you established connection, process id/application_name, user

Now that you have what you need, you may want to write a bash script to continue with the use of the information that you received from the first command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.