1

Once every 5 minutes or so a process on my machine, with my main user id, tries to open a connection to an unknown IP address (no rDNS) at an unusual TCP port (>1k). I can see this in the computer's IP firewall log because the connection is rejected every time:

[243678.820911] Firewall: *TCP_OUT Blocked* IN= OUT=eth1 SRC=192.168.1.33 DST=123.45.67.89 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31984 DF PROTO=TCP SPT=31339 DPT=1234 WINDOW=64240 RES=0x00 SYN URGP=0 UID=1234 GID=1234

Now, I want to find out which process it is (a few hundred are running) in order to stop it from trying, and to see whether this is something I should be concerned about.

How can I wait for, and detect, up to the process name, which process opens a connection to 123.45.67.89 at TCP port 3456 as user id 1234?

  • 1
    If the issue is regular ("every 5 minutes") then it may be a cron job, so looking at cron entries may be beneficial. Otherwise you could look at auditd and create an auditctl entry to log TCP session activity; eg auditctl -a exit,always -F arch=b64 -S connect -k FLAG will flag 64bit programs that call the connect(2) system call. You'll need a similar line for 32bit programs if you have both on your system – Stephen Harris Apr 7 at 19:53
  • Just to clarify: The firewall message is the PC's or your network's router? ... The IP address you listed in the question seems to belong to Samsung... So, if it's the router's firewall, I would say this is probably a Smart TV or phone or something trying to auto-update... you could use watch -n15 lsof -a -i4@123.45.67.89:3456 -u 1234 ... which will check every 15 seconds. – RubberStamp Apr 7 at 19:53
  • @RubberStamp Yes, they are on my machine, not the router. So, some Linux software component or web page in any of the 5 open browsers. – Ned64 Apr 9 at 21:09
  • @StephenHarris Thanks, I will look into the audit option, this may be just what I need. – Ned64 Apr 9 at 21:10
1

You could construct a tight loop with netstat like this:

while :; do netstat -np | awk '$5 ~ ":3456"  {print}'; done

It's not very efficient, but it should be able to capture the pid and name of your calling process.

  • Thanks, this might work, albeit at the expense of 100% CPU because of the busy waiting... still the netstat could miss the command - will try it out, though! – Ned64 Apr 9 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.