Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I tried looping with netstat and but the packets are small and not frequent so do not get caught (can still see them with tcpdump). Need to know which process sends those packets.

share|improve this question
    
Have you tired iptables --log-uid option? –  Cougar Mar 22 '12 at 8:39
add comment

2 Answers

up vote 1 down vote accepted

Check tcpdump for the source port number of the packets. Then run

sudo netstat -a -u -n --program

Look for the PID/Program name matching the source port number.

This assumes that the sending process is leaving its socket open between sends, which is what any normal program would do. If you are dealing a program that is deliberately trying to hide itself, that's whole different story.

share|improve this answer
add comment

I guess it should be possible with QUEUE target in iptables. But you'd need to write an userspace application to "check" those packets (and this appication could help you to know which process sends those packets). Sorry, I haven't got more details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.