We are stuck in identifying which process or service that we are running in our linux machine is making a connection to a remote IP. We are getting complaints of our network accessing the remote IP port 80 HTTP Tomcat Admin page access.

Using the below tcpdump, we were able to find that there is an outgoing request being made to the IP address from which we received the complaint, but not able to identify which process is making it.

tcpdump -vvv -i ens192 src and dst port 80

How can we find which process trying to make connection to specific IP in linux centos7 environment.


You could get auditd to log all connect() system calls:

sudo auditctl -a exit,always -F arch=b64 -S connect

And then, after you've observed the connection, search the logs with:

sudo ausearch -i -sc connect | grep -wC2 lport=80

There a few tools that might help. ntstat would be my first option

netstat -ltnp | grep -w ':80' 

The flags can be helpful

l – tells netstat to only show listening sockets. p – enables showing of the process ID and the process name.

Also try out

 lsof -i :80

or psmisc (haven't tested yet).

  • 1
    With lsof, you may want to restrict to TCP sockets (lsof -i tcp:80). On modern Linux, there's also ss -t 'dport == :80'. But for all those you need to run the command at the time the socket exits. – Stéphane Chazelas Jan 24 at 17:52
  • 1
    Another option is to redirect it (with iptables, etc) to a local port, and have a script listening on that port identify the culprit via ss, lsof, etc. That script could also accept the connection and see what he's trying to do ;-) – user414777 Jan 25 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.