IS there a means of identifying the application path for the process which attempts to access the internet on...
Is there a means (kernel mode API) under Linux (any distro) that can identify the application path of a process that makes a connect() call and is attempting to access the internet ? Vice versa in the same respect if the application is attempting to receive a TCP data packet is it possible to identify the process that is receiving the packet? I need to be able to map and log programmatically such details whether the process is executing in kernel or user mode.
linux linux-kernel tcp-ip
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
asked Jun 5 '17 at 21:22
David J
62
|
show 3 more comments
Is there a means (kernel mode API) under Linux (any distro) that can identify the application path of a process that makes a connect() call and is attempting to access the internet ? Vice versa in the same respect if the application is attempting to receive a TCP data packet is it possible to identify the process that is receiving the packet? I need to be able to map and log programmatically such details whether the process is executing in kernel or user mode.
linux linux-kernel tcp-ip
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
asked Jun 5 '17 at 21:22
David J
62
1
Depending on exactly what you are trying to accomplish, there are a few ways. You can look at the output ofnetstat -napto see which processes are bound to what ports. You can also use thelsofcommand to see what processes have ports open. Another method is to have auditing turned on and configure its rules to log system calls and a host of other items.
– Deathgrip
Jun 5 '17 at 22:01
1
unix.stackexchange.com/questions/366376/…
– thrig
Jun 5 '17 at 23:10
@Deathgrip trying to map each and every TCP packet (received/sent) or an entire stream to a process whether the process is executing in user or kernel mode. I also need to be able to do this programmatically. I want to be able to log these details. Does this help ?
– David J
Jun 5 '17 at 23:28
@thrig thank you. But can systemtap be interfaced programmatically via API and can it map a single TCP data packet (received or being sent) by a process or application whether this process is executing in kernel or user mode ?
– David J
Jun 5 '17 at 23:48
1
You don't need to look at packets at all; you just need to look at what sockets are open.
– psusi
Jun 6 '17 at 0:40
|
show 3 more comments
Is there a means (kernel mode API) under Linux (any distro) that can identify the application path of a process that makes a connect() call and is attempting to access the internet ? Vice versa in the same respect if the application is attempting to receive a TCP data packet is it possible to identify the process that is receiving the packet? I need to be able to map and log programmatically such details whether the process is executing in kernel or user mode.
linux linux-kernel tcp-ip
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
asked Jun 5 '17 at 21:22
David J
62
Is there a means (kernel mode API) under Linux (any distro) that can identify the application path of a process that makes a connect() call and is attempting to access the internet ? Vice versa in the same respect if the application is attempting to receive a TCP data packet is it possible to identify the process that is receiving the packet? I need to be able to map and log programmatically such details whether the process is executing in kernel or user mode.
linux linux-kernel tcp-ip
linux linux-kernel tcp-ip
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
asked Jun 5 '17 at 21:22
David J
62
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
asked Jun 5 '17 at 21:22
David J
62
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
edited Dec 20 '18 at 0:02
Rui F Ribeiro
39k1479130
39k1479130
asked Jun 5 '17 at 21:22
David J
62
asked Jun 5 '17 at 21:22
David J
62
asked Jun 5 '17 at 21:22
David J
62
62
1
Depending on exactly what you are trying to accomplish, there are a few ways. You can look at the output ofnetstat -napto see which processes are bound to what ports. You can also use thelsofcommand to see what processes have ports open. Another method is to have auditing turned on and configure its rules to log system calls and a host of other items.
– Deathgrip
Jun 5 '17 at 22:01
1
unix.stackexchange.com/questions/366376/…
– thrig
Jun 5 '17 at 23:10
@Deathgrip trying to map each and every TCP packet (received/sent) or an entire stream to a process whether the process is executing in user or kernel mode. I also need to be able to do this programmatically. I want to be able to log these details. Does this help ?
– David J
Jun 5 '17 at 23:28
@thrig thank you. But can systemtap be interfaced programmatically via API and can it map a single TCP data packet (received or being sent) by a process or application whether this process is executing in kernel or user mode ?
– David J
Jun 5 '17 at 23:48
1
You don't need to look at packets at all; you just need to look at what sockets are open.
– psusi
Jun 6 '17 at 0:40
|
show 3 more comments
1
Depending on exactly what you are trying to accomplish, there are a few ways. You can look at the output ofnetstat -napto see which processes are bound to what ports. You can also use thelsofcommand to see what processes have ports open. Another method is to have auditing turned on and configure its rules to log system calls and a host of other items.
– Deathgrip
Jun 5 '17 at 22:01
1
unix.stackexchange.com/questions/366376/…
– thrig
Jun 5 '17 at 23:10
@Deathgrip trying to map each and every TCP packet (received/sent) or an entire stream to a process whether the process is executing in user or kernel mode. I also need to be able to do this programmatically. I want to be able to log these details. Does this help ?
– David J
Jun 5 '17 at 23:28
@thrig thank you. But can systemtap be interfaced programmatically via API and can it map a single TCP data packet (received or being sent) by a process or application whether this process is executing in kernel or user mode ?
– David J
Jun 5 '17 at 23:48
1
You don't need to look at packets at all; you just need to look at what sockets are open.
– psusi
Jun 6 '17 at 0:40
1
1
Depending on exactly what you are trying to accomplish, there are a few ways. You can look at the output of
netstat -nap to see which processes are bound to what ports. You can also use the lsof command to see what processes have ports open. Another method is to have auditing turned on and configure its rules to log system calls and a host of other items.– Deathgrip
Jun 5 '17 at 22:01
Depending on exactly what you are trying to accomplish, there are a few ways. You can look at the output of
netstat -nap to see which processes are bound to what ports. You can also use the lsof command to see what processes have ports open. Another method is to have auditing turned on and configure its rules to log system calls and a host of other items.– Deathgrip
Jun 5 '17 at 22:01
1
1
unix.stackexchange.com/questions/366376/…
– thrig
Jun 5 '17 at 23:10
unix.stackexchange.com/questions/366376/…
– thrig
Jun 5 '17 at 23:10
@Deathgrip trying to map each and every TCP packet (received/sent) or an entire stream to a process whether the process is executing in user or kernel mode. I also need to be able to do this programmatically. I want to be able to log these details. Does this help ?
– David J
Jun 5 '17 at 23:28
@Deathgrip trying to map each and every TCP packet (received/sent) or an entire stream to a process whether the process is executing in user or kernel mode. I also need to be able to do this programmatically. I want to be able to log these details. Does this help ?
– David J
Jun 5 '17 at 23:28
@thrig thank you. But can systemtap be interfaced programmatically via API and can it map a single TCP data packet (received or being sent) by a process or application whether this process is executing in kernel or user mode ?
– David J
Jun 5 '17 at 23:48
@thrig thank you. But can systemtap be interfaced programmatically via API and can it map a single TCP data packet (received or being sent) by a process or application whether this process is executing in kernel or user mode ?
– David J
Jun 5 '17 at 23:48
1
1
You don't need to look at packets at all; you just need to look at what sockets are open.
– psusi
Jun 6 '17 at 0:40
You don't need to look at packets at all; you just need to look at what sockets are open.
– psusi
Jun 6 '17 at 0:40
|
show 3 more comments
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f369396%2fis-there-a-means-of-identifying-the-application-path-for-the-process-which-attem%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f369396%2fis-there-a-means-of-identifying-the-application-path-for-the-process-which-attem%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Depending on exactly what you are trying to accomplish, there are a few ways. You can look at the output of
netstat -napto see which processes are bound to what ports. You can also use thelsofcommand to see what processes have ports open. Another method is to have auditing turned on and configure its rules to log system calls and a host of other items.– Deathgrip
Jun 5 '17 at 22:01
1
unix.stackexchange.com/questions/366376/…
– thrig
Jun 5 '17 at 23:10
@Deathgrip trying to map each and every TCP packet (received/sent) or an entire stream to a process whether the process is executing in user or kernel mode. I also need to be able to do this programmatically. I want to be able to log these details. Does this help ?
– David J
Jun 5 '17 at 23:28
@thrig thank you. But can systemtap be interfaced programmatically via API and can it map a single TCP data packet (received or being sent) by a process or application whether this process is executing in kernel or user mode ?
– David J
Jun 5 '17 at 23:48
1
You don't need to look at packets at all; you just need to look at what sockets are open.
– psusi
Jun 6 '17 at 0:40