Linux Security Cookbook

9.14. Examining Local Network Activities

Problem

You want to examine network use occurring on your local machine.

Solution

To print a summary of network use:

$ netstat --inet                 Connected sockets
$ netstat --inet --listening     Server sockets
$ netstat --inet --all           Both
# netstat --inet ... -p          Identify processes

To print dynamically assigned ports for RPC services:

$ rpcinfo -p [host]

To list network connections for all processes:

# lsof -i[TCP|UDP][@host][:port]

To list all open files for specific processes:

# lsof -p pid
# lsof -c command
# lsof -u username

To list all open files (and network connections) for all processes:

# lsof

To trace network system calls, use strace . [Recipe 9.15]

Discussion

Suppose you see a process with an unfamiliar name running on your system. Should you be concerned? What is it doing? Could it be surreptitiously transmitting data to some other machine on a distant continent?

To answer these kinds of questions, you need tools for observing network use and for correlating activities with specific processes. Use these tools frequently so you will be familiar with normal network usage, and equipped to focus on suspicious behavior when you encounter it.

The netstat command prints a summary of the state of networking on your machine, and is a good way to start investigations. The —inet option prints active connections:

$ netstat --inet Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 240 myhost.example.com:ssh client.example.com:3672 ...