Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was wondering if it is possible to find out which process is trying to make a specific network connection. On a server I support which hosts websites for about 200 users, the iptables firewall keeps blocking, as it should, a connection to 212.117.169.139 on port 80. Firefox reports this as an attack page (and at the least is obvious spam, if not malicious).

It seems something on this server is trying to access this site for some reason, and although it's being blocked successfully, the requests seem to be going through every two to sixty seconds and I'd like to be able to find what process or script is doing this so I can handle it appropriately. Besides doing a grep to try and find if this IP is in some file (which probably won't even work because it may be working by hostname or it may be encoded), is there any way to find out some more information?

Thanks!

share|improve this question

2 Answers 2

up vote 2 down vote accepted

watch with netstat -p should help with that.

share|improve this answer
    
It's coming from httpd, I'll try and dig around further. –  Joseph Sep 1 '10 at 18:44
    
Either one of your web apps has been compromised, or you have a XSS vulnerability. Check your access logs. –  Ignacio Vazquez-Abrams Sep 1 '10 at 19:20

Serverfault has an answer, use auditd to track what program opening connections. Might be abit overkill for you..

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.