Network monitoring tools
netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with
ip we can see other connections with
ip -all netns exec ss).
The kernel state the connections here
/proc/net/tcp[udp][raw] and namespace connections can be seen here
What are the other possible connections that are not seen by ss/lsof/netstat and how to monitor them?
NFQUEUEcan reveal connections as they happen, but it might be tricky to set up and not miss anything (
OpenSnitchhas a number of closed issues covering that part, although I'm not sure if there's anything about Layer2 there) 2) I'm guessing that kernel extensions are able to make unnoticed connections if they talk directly to NIC (not directly applicable on Linux, but I'm observing something like this on a Mac, where VirtualBox is able to bypass Little Snitch when in bridged mode).
watch -n1 ssyou won't see connections established and closed within less than 1 second.