Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if it is possible to find out which process is trying to make a specific network connection. On a server I support which hosts websites for about 200 users, the iptables firewall keeps blocking, as it should, a connection to 212.117.169.139 on port 80. Firefox reports this as an attack page (and at the least is obvious spam, if not malicious).

It seems something on this server is trying to access this site for some reason, and although it's being blocked successfully, the requests seem to be going through every two to sixty seconds and I'd like to be able to find what process or script is doing this so I can handle it appropriately. Besides doing a grep to try and find if this IP is in some file (which probably won't even work because it may be working by hostname or it may be encoded), is there any way to find out some more information?

Thanks!

share|improve this question
up vote 2 down vote accepted

watch with netstat -p should help with that.

share|improve this answer
    
It's coming from httpd, I'll try and dig around further. – Joseph Sep 1 '10 at 18:44
    
Either one of your web apps has been compromised, or you have a XSS vulnerability. Check your access logs. – Ignacio Vazquez-Abrams Sep 1 '10 at 19:20

Serverfault has an answer, use auditd to track what program opening connections. Might be abit overkill for you..

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .