Once every 5 minutes or so a process on my machine, with my main user id, tries to open a connection to an unknown IP address (no rDNS) at an unusual TCP port (>1k). I can see this in the computer's IP firewall log because the connection is rejected every time:
[243678.820911] Firewall: *TCP_OUT Blocked* IN= OUT=eth1 SRC=192.168.1.33 DST=220.127.116.11 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31984 DF PROTO=TCP SPT=31339 DPT=1234 WINDOW=64240 RES=0x00 SYN URGP=0 UID=1234 GID=1234
Now, I want to find out which process it is (a few hundred are running) in order to stop it from trying, and to see whether this is something I should be concerned about.
How can I wait for, and detect, up to the process name, which process opens a connection to 18.104.22.168 at TCP port 3456 as user id 1234?