0

I have pfSense set up to block outgoing connections on ports that are not specified in a config. Now, looking through the firewall logs, I see various ports that are being used and blocked for outgoing traffic. I have access to the machine that is generating the outgoing traffic that is blocked.

I am able to see what ports Ubuntu is listening on using the command netstat -nputw. It also shows the program that is using the port which is what I'm looking for except for outgoing traffic. Does anybody know how I can tell what program is responsible for outgoing traffic on say port 6969?

Also, can I tell which program sends traffic to certain IP addresses?

1

2 Answers 2

0

the command you used shows for both outgoing and incoming traffic. If you add -l to your flags, then it would show listening ports. You also could have added a -cflag for continuous and then appended a | grep 6969 to see matching lines for 6969...

It would still been a little difficult to isolate only outgoing traffic from that...

ss offers more options to play with than netstat.

or something like nethogs presents that live data.
apt-get install nethogs

0

Read man lsof and do

sudo lsof -i tcp:6969

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.