14

At the moment I have an application/service/widget/plugin/cronjob whatever, accessing the internet on a regular basis. I could go into the details of my specific issue but I'd rather have an answer that will allow me to fault find it my self and in the process learn more about Ubuntu.

I'm using dnstop at the moment to display all of the DNS requests that are being made on my network. Currently for arguments sake, there is a request going to weather.noaa.gov on a 15 minute cycle. It's probably a weather widgit although I have checked my processes and found nothing, and the request is comming from my computer.

So the question, how do I determine what process is accessing weather.noaa.gov?

I don't want to go through a process of ellimination by shutting down each service/plugin/application to figure this out. I would like to find a way to determine what process is making that DNS request.

If I had a decent "Application Firewall" the request would have never been made. But this is a "horse has already bolted" scenario and would like to find that "rogue" process that is making that DNS request.

2 Answers 2

7

If you don't mind having an infinite loop running for some time, you can run netstat continuously and filter the output for the IP address of the computer to which your program is connecting. I suggest using IP addresses instead of domain names because it's much faster, reducing the time each netstat call takes and therefore increasing the chances of actually catching your process. You should run the netstat command as root, if you think that the process does not belong to the currently logged in user. So, first use nslookup to figure the IP of the domain:

nslookup weather.noaa.gov

For me this gives at the moment: 193.170.140.70 and 193.170.140.80. Now you can put up an infinte loop of netstats. The output you can filter using grep (and discard STDERR).

while [ true ] ;  do netstat -tunp 2>/dev/null | grep -e 193.170.140.70 -e 193.170.140.80  ; done

Of course edit the IP addresses in the above example. This example is probing for TCP and UDP (-tu) connections, does not do DNS resolution (-n) and lists the processes (-p). If you think there's enough time to do DNS resolution, simply omit the -n option for netstat and put the domain for grep instead of the IP. You can stop the infinite loop by simply pressing CTRL+c

Hope this helps, Andreas

PS: I know, this is not the ideal, efficient or clean way to do it, but for a one-time search this should be sufficient.

1
  • I will give that a go and see if I can catch my culprit
    – Meer Borg
    Mar 27, 2013 at 10:21
3

You could also "break" the application via /etc/hosts addition of the FQDN that's being connected to. Give it some non-routable IP like 10.1.2.3 (or 127.0.0.1) and see what breaks.

1
  • I normally set it to 0.0.0.0 as it doesn't route, the kind of Apps I'm talking about rarely announce their "naughtyness"
    – Meer Borg
    Apr 3, 2013 at 5:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .