Linux get all connection

How to list all the current network connections for a given PID?

but this does not seem to work. I need a command that will take that PID and print all the open network connections but I have no idea how. I have seen on other forms about strace but this does not make sense to me.

4 Answers 4

If you’re not root , you’ll only be able to get that for your processes.

Technically, that’s only for the internet sockets (connected or not).

If you want all established connections (or associations), internet or not (like for Unix domain sockets), you could try (at least on Linux and with lsof 4.89):

lsof -Ep "$pid" | grep -e '(ESTABLISHED)$' -e '->INO=.* ' 

For instance, for the process I use to write this answer, that gives:

firefox 6261 chazelas 3u unix 0xffff88026785d000 0t0 741948 type=STREAM ->INO=743009 4244,dbus-daem,58u firefox 6261 chazelas 4u unix 0xffff88017194c000 0t0 741280 type=STREAM ->INO=742999 3575,Xorg,57u firefox 6261 chazelas 6u unix 0xffff8802f544d400 0t0 743000 type=STREAM ->INO=741281 4244,dbus-daem,56u firefox 6261 chazelas 11u unix 0xffff8802f544e800 0t0 743004 type=STREAM ->INO=737278 4167,cinnamon-,21u firefox 6261 chazelas 14u unix 0xffff8801474b3c00 0t0 737279 type=STREAM ->INO=737280 6261,firefox,15u firefox 6261 chazelas 15u unix 0xffff8801474b7c00 0t0 737280 type=STREAM ->INO=737279 6261,firefox,14u firefox 6261 chazelas 34u unix 0xffff8801d0d01800 0t0 741294 type=STREAM ->INO=743006 4244,dbus-daem,57u firefox 6261 chazelas 45u IPv4 741950 0t0 TCP UNKNOWN:44232->host24-rangeA-akamai-aanp.cdn.thlon.isp.sky.com:http (ESTABLISHED) firefox 6261 chazelas 53u unix 0xffff880178356800 0t0 741947 type=STREAM ->INO=743008 3575,Xorg,56u firefox 6261 chazelas 60u IPv4 743011 0t0 TCP UNKNOWN:52760->a95-101-128-57.deploy.akamaitechnologies.com:http (ESTABLISHED) firefox 6261 chazelas 73u IPv4 742158 0t0 TCP UNKNOWN:54674->lhr35s01-in-f14.1e100.net:http (ESTABLISHED) firefox 6261 chazelas 87u IPv4 743521 0t0 TCP UNKNOWN:33564->stackoverflow.com:https (ESTABLISHED) firefox 6261 chazelas 91u IPv4 743522 0t0 TCP UNKNOWN:53940->93.184.220.29:http (ESTABLISHED) firefox 6261 chazelas 92u IPv4 742153 0t0 TCP UNKNOWN:36836->151.101.65.69:https (ESTABLISHED) firefox 6261 chazelas 94u IPv4 742154 0t0 TCP UNKNOWN:33716->192.0.73.2:https (ESTABLISHED) firefox 6261 chazelas 96u IPv4 742157 0t0 TCP UNKNOWN:51166->lhr26s04-in-f234.1e100.net:https (ESTABLISHED) firefox 6261 chazelas 113u IPv4 744875 0t0 TCP UNKNOWN:43262->lhr35s01-in-f1.1e100.net:https (ESTABLISHED) 

Источник

How to Find All Clients Connected to HTTP or HTTPS Ports

In this short quick article, you will learn how to find all clients (using their IP addressees) connected to an Apache or Nginx web server on HTTP or HTTPS ports on a Linux server.

In Linux, every service running on the server listening to the socket for a client to make a connection request. Upon a successful connection from a client, a socket (a combination of an IP address and a port (a number which identifies an application/service the client is connected to)) is created.

To get the detailed information of these sockets, we will use a ss command-line tool, which is used to display network socket related information on a Linux machine. You can also use the older netstat command, which displays active socket connections.

For example, you can use these tools to get the socket statistics information of all clients connected to a specific port or service.

To get the list of all clients connected to HTTP (Port 80) or HTTPS (Port 443), you can use the ss command or netstat command, which will list all the connections (regardless of the state they are in) including UNIX sockets statistics.

# ss -o state established '( sport = :http or sport = :https )' OR # netstat -o state established '( sport = :http or sport = :https )'

Alternatively, you can run the following command to list the numerical port numbers.

# ss -tn src :80 or src :443 OR # netstat -tn src :80 or src :443

You might also find the following articles useful:

That’s all we have in this short article. For more information about the ss utility, read its man page (man ss). You can reach us for any questions, via the comment form below.

Источник

List all internet connections

I’d like to know all the connections my system is making to the internet. I tried netstat but that shows a lot of connections — all of which aren’t applicable I think. Can it be displayed like top does for processes ? I’m a little security conscious and would like to know all the incoming and outgoing connections happening on my system.

2 Answers 2

Using netstat

netstat by itself monitors all major protocols including TCP and UDP on every port.

If you want to display TCP and UDP connections:

If you want to display that continously:

Similar to top :

1. nethogs — shows a list of the top processes that use bandwidth
2. jnettop — shows list of top connections
3. iftop — shows list of top connections with bandwidth bars

GUI Interface (just in case):

You may try ss as well, it’s more advanced than netstat .

List all TCP connections (including those with non-established state, e.g. SYN-SENT , LISTEN , and TIME-WAIT ). Read more about TCP states transition in RFC793.

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 4096 127.0.0.1:5672 0.0.0.0:* ESTAB 0 0 192.168.1.4:57310 35.157.63.229:443 ESTAB 0 0 127.0.0.1:43764 127.0.0.1:8080 CLOSE-WAIT 1 0 192.168.1.4:34554 142.250.186.33:443 CLOSE-WAIT 1 0 192.168.1.4:34564 142.250.186.33:443 

Include information about the owner process of the connections (e.g., process name and PID)

Display all established SSH connections.

List all the TCP sockets in state FIN-WAIT-1 for network 193.233.7/24 and look at their timers with —options , which shows timer information.

Источник

View your Linux server’s network connections with netstat

The netstat command provides important insight into your Linux server, both for monitoring and network troubleshooting.

I shared some important first steps to help manage your personal Linux server in a previous article. I briefly mentioned monitoring network connections for listening ports, and I want to expand on this by using the netstat command for Linux systems.

Service monitoring and port scanning are standard industry practices. There’s very good software like Prometheus to help automate the process, and SELinux to help contextualize and protect system access. However, I believe that understanding how your server connects to other networks and devices is key to establishing a baseline of what’s normal for your server, which helps you recognize abnormalities that may suggest a bug or intrusion. As a beginner, I’ve discovered that the netstat command provides important insight into my server, both for monitoring and network troubleshooting.

Netstat and similar network monitoring tools, grouped together in the net-tools package, display information about active network connections. Because services running on open ports are often vulnerable to exploitation, practicing regular network monitoring can help you detect suspicious activity early.

Install netstat

Netstat is frequently pre-installed on Linux distributions. If netstat is not installed on your server, install it with your package manager. On a Debian-based system:

$ sudo apt-get install net-tools

Use netstat

On its own, the netstat command displays all established connections. You can use the netstat options above to specify the intended output further. For example, to show all listening and non-listening connections, use the —all ( -a for short) option. This returns a lot of results, so in this example I pipe the output to head to display just the first 15 lines of output:

$ netstat --all | head -n 15 Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 *:27036 *:* LISTEN tcp 0 0 localhost:27060 *:* LISTEN tcp 0 0 *:16001 *:* LISTEN tcp 0 0 localhost:6463 *:* LISTEN tcp 0 0 *:ssh *:* LISTEN tcp 0 0 localhost:57343 *:* LISTEN tcp 0 0 *:ipp *:* LISTEN tcp 0 0 *:4713 *:* LISTEN tcp 0 0 10.0.1.222:48388 syd15s17-in-f5.1e:https ESTABLISHED tcp 0 0 10.0.1.222:48194 ec2-35-86-38-2.us:https ESTABLISHED tcp 0 0 10.0.1.222:56075 103-10-125-164.va:27024 ESTABLISHED tcp 0 0 10.0.1.222:46680 syd15s20-in-f10.1:https ESTABLISHED tcp 0 0 10.0.1.222:52730 syd09s23-in-f3.1e:https ESTABLISHED

To show only TCP ports, use the —all and —tcp options, or -at for short:

$ netstat -at | head -n 5 Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 *:27036 *:* LISTEN tcp 0 0 localhost:27060 *:* LISTEN tcp 0 0 *:16001 *:* LISTEN

To show only UDP ports, use the —all and —udp options, or -au for short:

$ netstat -au | head -n 5 Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 *:27036 *:* udp 0 0 10.0.1.222:44741 224.0.0.56:46164 ESTABLISHED udp 0 0 *:bootpc 

The options for netstat are often intuitive. For example, to show all listening TCP and UDP ports with process ID (PID) and numerical address:

$ sudo netstat --tcp --udp --listening --programs --numeric Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Addr State PID/Program name tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 2500/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1726/sshd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1721/cupsd tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 4023/sshd: tux@ tcp6 0 0 . 111 . * LISTEN 1/systemd tcp6 0 0 . 22 . * LISTEN 1726/sshd tcp6 0 0 ::1:631 . * LISTEN 1721/cupsd tcp6 0 0 ::1:6010 . * LISTEN 4023/sshd: tux@ udp 0 0 0.0.0.0:40514 0.0.0.0:* 1499/avahi-daemon: udp 0 0 192.168.122.1:53 0.0.0.0:* 2500/dnsmasq udp 0 0 0.0.0.0:67 0.0.0.0:* 2500/dnsmasq udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd udp 0 0 0.0.0.0:5353 0.0.0.0:* 1499/avahi-daemon: udp6 0 0 . 111 . * 1/systemd udp6 0 0 . 44235 . * 1499/avahi-daemon: udp6 0 0 . 5353 . * 1499/avahi-daemon:

The short version of this common combination is -tulpn .

To display information about a specific service, filter with grep :

$ sudo netstat -anlp | grep cups tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1721/cupsd tcp6 0 0 ::1:631 . * LISTEN 1721/cupsd unix 2 [ ACC ] STREAM LISTENING 27251 1/systemd /var/run/cups/cups.sock unix 2 [ ] DGRAM 59530 1721/cupsd unix 3 [ ] STREAM CONNECTED 55196 1721/cupsd /var/run/cups/cups.sock

Next steps

Once you’ve run the netstat command, you can take steps to secure your system by ensuring that only services that you actively use are listening on your network.

1. Recognize commonly exploited ports and services. As a general rule, close the ports you’re not actually using.
2. Be on the lookout for uncommon port numbers, and learn to recognize legitimate ports in use on your system.
3. Pay close attention to SELinux errors. Sometimes all you need to do is update contexts to match a legitimate change you’ve made to your system, but read the errors to make sure that SELinux isn’t alerting you of suspicious or malicious activity.

If you find that a port is running a suspicious service, or you simply want to close a port that you no longer use, you can manually deny port access through firewall rules by following these steps:

If you’re using firewall-cmd , run these commands:

$ sudo firewall-cmd –remove-port=/tcp $ sudo firewall-cmd –runtime-to-permanent

If you’re using UFW, run the following command:

Next, stop the service itself using systemctl :

Learn netstat

Netstat is a useful tool to quickly collect information about your server’s network connections. Regular network monitoring is important an important part of getting to know your system, and it helps you keep your system safe. To incorporate this step into your administrative routine, you can use network monitoring tools like netstat or ss, as well as open source port scanners such as Nmap or sniffers like Wireshark, which allow for scheduled tasks.

As servers house larger amounts of personal data, it’s increasingly important to ensure the security of personal servers. By understanding how your server connects to the Internet, you can decrease your machine’s vulnerability, while still benefiting from the growing connectivity of the digital age.

7 steps to securing your Linux server

Harden your Linux server in seven easy steps.

6 open source tools and tips to securing a Linux server for beginners

Use open source tools to protect your Linux environment from breaches.

9 things to do in your first 10 minutes on a Linux server

Before putting a newly provisioned server to work, make sure you know what you’re working with.

Источник