Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I would like to examine the network traffic being handled by a single process, but simple network captures won't work since I am dealing with such a busy system (lots of other traffic happening at the same time). Is there a way to isolate a tcpdump or wireshark capture to the networking traffic of a single specific process? (Using netstat is insufficient.)

share|improve this question
add comment

11 Answers

up vote 10 down vote accepted

Indeed there is a way, using the Wireshark filters. But you cannot filter directly by process name or PID (because they are not a network quantities).

You should first figure out the protocols and the ports used by your process (the netstat command in the previous comment works well).

Then use Wireshark to filter the inbound (or outbound) port with the one you just retrieve. That should isolate the incoming and outcoming traffic of your process.

share|improve this answer
1  
For a simple connection, this is possible, but I need to track DNS, HTTP, etc, that are all rushing past, so there isn't a simple way to just use netstat and simple network capture filters on a busy machine. –  Kees Cook Nov 6 '10 at 18:12
    
Ok, HTTP and DNS public ports are used by a lot of application, but the corresponding private port is unique. So why don't you try filtering by the private port? –  OpenNingia Nov 8 '10 at 11:13
    
Because rapid small requests won't be seen by netstat; I'll only be able to catch long-lived connections. :( –  Kees Cook Nov 8 '10 at 18:58
    
what if the process uses dynamic ports at run time, then your not going to be able to uses static port filters –  user5883 Nov 10 '10 at 10:00
    
I think you've here the best answer... Sadly a network sniffing tool works at the lowest level of the net stack, trying to catch everything, it's completely unaware of processes running on the OS. It'd be extremely difficult to find out what's originated a certain call. A packet sniffer could eventually figure out (via the port number) a process ID but cannot figure out which process did a DNS lookup as this is completely independent (that's most probably the kernel net stack that triggered the call). But with filtering and stoping other processes you should be able to achieve your goal. –  Huygens Nov 10 '10 at 13:05
show 1 more comment

To start and monitor an new process:

strace -f -e trace=network -s 10000 PROCESS ARGUMENTS

To monitor an existing process with a known pid:

strace -p $PID -f -e trace=network -s 10000

share|improve this answer
    
This is useful because it can be used without having root access or special permissions (on some Linux distributions, anyway - on Ubuntu you may need special permissions). –  Robin Green Jun 7 '12 at 9:24
add comment
netstat -taucp | grep <pid or process name>

That will show the connections an application is making including the port being used.

share|improve this answer
2  
This would show connections that exist for that instant, but it won't provide a log of the traffic itself. –  Kees Cook Nov 6 '10 at 17:36
    
Not sure about the Kees Cook comment. A simple netstat shows info about connections for an instant, but with the flag -c you get a snapshot of that state every second (see 'man netstat'). Maybe it does not have all the traffic, but is not a unique snapshot of the connections. –  tremendows Dec 12 '13 at 15:30
add comment

This is a dirty hack but I'd suggest either a divert or a log target with iptables for a given UID. eg:

iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner $USER -m tcp -j LOG 
iptables -t nat -A OUTPUT -p udp -m owner --uid-owner $USER -m udp -j LOG 

It might also be worth looking into something like '--log-tcp-sequence', '--log-tcp-options', '--log-ip-options', '--log-uid' for that log target. Though I suspect that will only help you post process a pcap that includes a ton of other data.

The NFLOG target might be useful if you want to flag packets and then certain tagged packets will be sent over a netlink socket to a process of your choosing. I wonder if that would be useful for hacking up something with wireshark and your specific application running as a specific user?

share|improve this answer
add comment

Just an idea: Is it possible to bind your application to a different IP address? If so, you can use the usual suspects (tcpdump, etc.)

Tools for applications which are not capable of binding to another IP address:

http://freshmeat.net/projects/fixsrcip

fixsrcip is a tool for binding outgoing TCP and UDP client sockets (IPv4) to specific source IP addresses on multi-homed hosts

http://freshmeat.net/projects/force_bind

force_bind allows you to force binding on a specific IP and/or port. It works with both IPv4 and IPv6.

share|improve this answer
    
Most applications don't support specifying their source IP, but this actually might be possible by using a container with CLONE_NEWNET but not CLONE_NEWNS. –  Kees Cook Nov 11 '10 at 6:14
    
I added some tools which may help binding to an IP –  Clausi Jan 7 '11 at 9:59
    
Alternatively, you can create a network namespace and run your app inside it www.evolware.org/?p=293 –  Flint May 17 at 4:29
add comment

Try running the process you're interested in under strace:

strace ping www.askubuntu.com

It will give you some very detailed information about what your process is doing. As a process can open up any ports it wants to anywhere, using a predefined filter you may miss something.

Another approach would be to use a stripped-down virtual machine or a test machine on your network, and place your process on it in isolation on this. Then you can just use Wireshark to catch all from that machine. You'll be pretty sure that the traffic you capture will be relevant.

share|improve this answer
    
works great for osx –  somid3 Jun 18 at 20:41
add comment

Building on the answer by ioerror I suspect you can use iptables --uid-owner to set a marker on the traffic, and then you can ask wireshark to capture only traffic with that marker. You might be able to use a DSCP (differential services marker), flow id or a qos marker.

Or indeed you could use this to send those packets out a different interface, and then capture only on that interface.

share|improve this answer
add comment

I have come to a similar issue and I was able to sort it out based on this answer by ioerror, using NFLOG as described here:

# iptables -A OUTPUT -m owner --uid-owner 1000 -j CONNMARK --set-mark 1
# iptables -A INPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 
# iptables -A OUTPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 
# dumpcap -i nflog:30 -w uid-1000.pcap

Then you can create run the process in question from a user account that doesn't do anything else - and voila, you have just isolated and captured traffic from a single process.

Just wanted to post back in case it helps anyone.

share|improve this answer
add comment

maybe iptables and ulog can work? Not that I have an exact recipe, but I think iptables can match processes, once matched you could use ulog.

share|improve this answer
3  
Unfortunately, iptables -m owner --pid-owner $PID was removed in Linux 2.6.14: ftp.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.14 –  Kees Cook Nov 6 '10 at 18:11
add comment

You can try tracedump - http://mutrics.iitis.pl/tracedump

It does exactly what you want, you can either give it a process ID or a program to run.

share|improve this answer
add comment

I think you can create a shell script to loop through executing netstat and logging it to a text file. Something like (very rough steps):

echo "press q to quit"
while [ <q is not pressed>]
do
    `netstat -taucp | grep <pid or process name> 1>>logfile.txt`
done

I am not a programmer, so I can't refine this. But someone here can start from where I left off and create a working script for you.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.