How can I capture network traffic of a single process?

Question

I would like to examine the network traffic being handled by a single process, but simple network captures won't work since I am dealing with such a busy system (lots of other traffic happening at the same time). Is there a way to isolate a tcpdump or wireshark capture to the networking traffic of a single specific process? (Using netstat is insufficient.)

Answer 1

Indeed there is a way, using the wireshark filters. But you cannot filter directly by process name or PID (because are not network quantity).

You should first figure out the protocols and the ports used by your process (the netstat command in the previous comment works well).

Then use wireshark to filter the inbound (or outbound) port with the one you just retrieve.

That should isolate the incoming and outcoming traffic of your process.

Answer 2

To start and monitor an new process:

strace -f -e trace=network -s 10000 PROCESS ARGUMENTS

To monitor an existing process with a known pid:

strace -p $PID -f -e trace=network -s 10000

Answer 3

netstat -taucp | grep <pid or process name>

That will show the connections an application is making including the port being used.

Answer 4

try running the process your interested in under strace.

strace ping www.askubuntu.com

will give you some very detailed information about what your process is doing. As a process can open up any ports it wants to anywhere, using a predefined filter you may miss something.

Another approach would to use a stripped down virtual machine or a test machine on your network, and place your process on in isolation on this. Then you can just use wireshark to catch all from that machine, you'll be pretty sure that the traffic you capture will be relevant.

Answer 5

This is a dirty hack but I'd suggest either a divert or a log target with iptables for a given UID. eg:

iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner $USER -m tcp -j LOG 
iptables -t nat -A OUTPUT -p udp -m owner --uid-owner $USER -m udp -j LOG 

It might also be worth looking into something like '--log-tcp-sequence', '--log-tcp-options', '--log-ip-options', '--log-uid' for that log target. Though I suspect that will only help you post process a pcap that includes a ton of other data.

The NFLOG target might be useful if you want to flag packets and then certain tagged packets will be sent over a netlink socket to a process of your choosing. I wonder if that would be useful for hacking up something with wireshark and your specific application running as a specific user?

Answer 6

Just an idea: Is it possible to bind your application to a different IP? So that you can use the usual suspects (tcpdump...)

Tools for applications which are not capable of binding to another ip:

http://freshmeat.net/projects/fixsrcip

fixsrcip is a tool for binding outgoing TCP and UDP client sockets (IPv4) to specific source IP addresses on multi-homed hosts

http://freshmeat.net/projects/force_bind

force_bind allows you to force binding on a specific IP and/or port. It works with both IPv4 and IPv6.

Answer 7

Building on the answer by ioerror I suspect you can use iptables --uid-owner to set a marker on the traffic, and then you can ask wireshark to capture only traffic with that marker. You might be able to use a DSCP (differential services marker), flow id or a qos marker.

Or indeed you could use this to send those packets out a different interface, and then capture only on that interface.

Answer 8

maybe iptables and ulog can work? Not that I have an exact recipe, but I think iptables can match processes, once matched you could use ulog.

Answer 9

I think you can create a shell script to loop through executing netstat and logging it to a text file. something like (very rough steps)

echo "press q to quit" while [ ] do netstat -taucp | grep <pid or process name> 1>>logfile.txt done

i am not a programmer so cant refine this. but someone here can start from where i left and create a working script for you.