We have an application that sends some data over the TCP/IP network. We don't know which process that would be, but we want to target it. All we know is the following nftables log:

kernel: * OUTPUT * IN= OUT=bond0 SRC= DST= LEN=60 
TOS=0x00 PREC=0x00 TTL=64 ID=39568 DF PROTO=TCP SPT=56784 DPT=443 SEQ=3504435004
(020405B40402080A03AC71A60000000001030309) UID=1000 GID=1000

The process also exits after it sends the packet, which happens really fast. How can we find out the PID/name/path of the process?

  • A TCP request from an unprivileged user to an Akamitech server. A web browser maybe? How do you know the process exits? – Kusalananda Feb 6 '19 at 9:49
  • No, it was wget , but in this case I knew what it was, but let's pretend we don't know that, and we want to find out what application that can be, so if in the future some app would get logged by nftables, we would know how to target it. – Mikhail Morfikov Feb 6 '19 at 9:52
  • You have the UID in the log. With process accounting turned on it may be possible to correlate the accounting data with the log. I wouldn't know how to da that in an automated fashion though as I don't know what Unix you are on. – Kusalananda Feb 6 '19 at 9:55
  • 1
    You could monitor processes via the proc connector interface of linux, and try to time correlate with the iptables log. There's forkstat in debian which is kind of a (quite unsatisfactory) sample program using the proc connector. – Uncle Billy Feb 6 '19 at 10:36
  • 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.