0

I have pfSense set up to block outgoing connections on ports that are not specified in a config. Now, looking through the firewall logs, I see various ports that are being used and blocked for outgoing traffic. I have access to the machine that is generating the outgoing traffic that is blocked.

I am able to see what ports Ubuntu is listening on using the command netstat -nputw. It also shows the program that is using the port which is what I'm looking for except for outgoing traffic. Does anybody know how I can tell what program is responsible for outgoing traffic on say port 6969?

Also, can I tell which program sends traffic to certain IP addresses?

1

2 Answers 2

0

the command you used shows for both outgoing and incoming traffic. If you add -l to your flags, then it would show listening ports. You also could have added a -cflag for continuous and then appended a | grep 6969 to see matching lines for 6969...

It would still been a little difficult to isolate only outgoing traffic from that...

ss offers more options to play with than netstat.

or something like nethogs presents that live data.
apt-get install nethogs

0

Read man lsof and do

sudo lsof -i tcp:6969

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .