parsed.org

Tips by tag: sockets

Network Forensics by cygnus on Jan 21, 2005 08:31 AM

You can use the lsof (LiSt Open Files) utility to view information about which processes own file handles on a system. Since sockets map to file descriptors, lsof will show you which processes own socket connections. If you see that your machine is connected to another on TCP port 6234 (source or dest) and you want to find out which process(es) are responsible for the connection, run:

# lsof -ni tcp:6234

Note that when run as an unprivileged user, lsof will only show you file descriptors that you have permission to see. You must run lsof as root to see everything in the kernel.

commandsconnectionsdebuggingdescriptorsfilesystemlsofmonitoringnetworkpermissionsprocesssocketsutilities
RSS