21

I have a service, keeping a certain port open.

I'm getting data to it, that I neither expect nor want to get, and I'm trying to pin-point the source of this data. So how can I find which process that sends data to a specific port, as opposed to which process is listening.

22

For TCP (though the same approach would work for SCTP1 or any connection-oriented transport protocol), same as for looking for listening ones:

lsof -nPi tcp:the-port

Will report the processes that have a TCP socket open on that port. If you know the source port (your server application can know about it and log it), you can use that instead to pinpoint the rogue client.

For UDP or RAW sockets, it would be trickier though I suppose it's where something like systemtap or dtrace can come handy. Possibly auditd as well.


1 Though SCTP support (on Linux only) was added to lsof in version 4.86, you cannot use -i to ask for SCTP sockets explicitly. Here can use lsof -nP | grep -w 'SCTP.*:the-port' as a heuristic instead.

  • This isn't working for SCTP for me. – sudo May 25 '17 at 2:28
  • 1
    @sudo, see edit – Stéphane Chazelas May 25 '17 at 6:38
2

Depending on the type of connection it establishes to send data one of these approaches will get you somewhere.

  • Use tcpdump port 1234 to acquire the data being sent to this port. You can use a program like Wireshark to analyze it on another machine (captured to a file using the -w option). Alternatively, use Wireshark directly.

  • In case it establishes and keeps open a tcp/udp connection you could use netstat to find the remote IP of the connection.

  • List open sockets of a process as in the answer provided by @StephaneChazelas.

1

You may use sockstat command to find the process which has initiated connection to your service on the local host.

DESCRIPTION
     The sockstat command lists open Internet or UNIX domain sockets.

Just match all source connections to your destination. This works fine for TCP/UDP/UNIXsockets.

1

Try following:

$sudo ss -tp

Or:

$sudo netstat -A inet -p

To avoid localhost result:

$sudo netstat -A inet -p | grep -v localhost

To list out only ESTABLISHED connections:

$sudo netstat -A inet -p | grep -v localhost | grep ESTABLISHED
0

On Solaris, running pfiles on all processes should show which processes have which connections open. It will require some careful filering, probably using ggrep's -A, -B options...

On Linux, netstat -anp --inet will work, even without lsof installed. (drop the --inet to get Unix domain sockets as well)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.