Which app or service connected to a specific domain?

Question

How do I find out which app or service tried to access a particular domain or url in the past?

Tried searching for this here and other websites but not getting relevant results.

I have the Gnome Logs program installed but apparently it does not give this info.

Would appreciate any help or guidance.

Thanks.

If it was still open, ss -p or netstat -p as root would answer. Otherwise, I can't think of a way short of configuring autiding. — user10489, Commented Jun 13 at 4:58
@user10489 In the past, not currently open connections. Thanks. — Ohbunter, Commented Aug 3 at 11:43
Unless the program itself logged it, or you set up iptables logging, this is not possible ex post facto — muru, Commented Aug 3 at 11:43

user10489 · Accepted Answer · 2024-08-05 03:44:17Z

The netstat and ss commands can only give information about currently open connections and very very recently closed connections.

Here's a list of possible sources for past (or potentially future) connections:

You may be able to search config files for various applications as well as systemd *.socket files to find what is configured to use a particular port.
Both /etc/services and the IANA protocol registry lists potential uses for various ports. You might be able to guess the application from those if it is using a standard port.
If the application drops logs of opening and closing the port, you might be able to find it from that.
The only reliable way to get past information like this is to enable auditing (apt install auditd) which must be done before the event, and then auditd can collect logs of all port openings along with a lot of other noise.
None of the above will log domains or URLs. You might be able to enable additional logging on the system hostname resolvers but this will only get the hostname part of the URL and will miss things that bypass system hostname resolution like dns over https or even regular dns that goes direct to external dns servers.
Nothing can log URLs except the application itself, unless you block all outgoing traffic and force it through a proxy server.
It would also be possible to collect hostnames and ip addresses via some fancy firewall rules and a forced dns proxy.

Thanks for the updated answer. "Nothing can log URLs except the application itself, unless you block all outgoing traffic and force it through a proxy server." Does this apply to IP addresses too? I'm also trying to search the website's IPv4 server address. Not sure if I should update question to include IP address or create new question... — Ohbunter, Commented Aug 5 at 1:27
Yes, you can't get URLs by ip either. But you could collect the ips themselves via ss netstat and auditd. — user10489, Commented Aug 5 at 3:43

1 Answer 1