ansaurus

Question

how i can identify which process is making UDP traffic on linux ?

Answer 1

A:

 netstat -anp |grep -i udp

The process is at the last column

ghostdog74 2010-10-20 11:27:25

i'have already tried it with more option, netstat -anpue, where u stand for udp and e for extended info, i also tried with -c continous option. the problem is that i need to call netstat when the 'infamous' process make udp traffic and is not possible to call it in extact istant it's made it. for a test i have wrote a C loop calling gethostbyname and every 10 seconds i able to view the traffic by netstat but i miss a lot of request. any way to have a historic and consistent way of udp/process traffic ?

boos 2010-10-20 12:28:20

Answer 2

+1 A:

Are these UDP DNS requests going to the name servers your Fedora box is configured to use? Just opening Firefox and going to http://www.google.com will generate a stream of UDP packets as name resolution happens. Run tcpdump port 53 in a terminal window, open Firefox and go to some website, you'll see what I mean.

mazianni 2010-10-20 14:13:38

Run `tcpdump port 53` and pipe output to log file, this way you'll see port of application which makes UDP requests. By knowing port of application, you can find application process itself.

Victor Sorokin 2010-10-20 14:44:38

You can see the src port, true, but it being UDP there's a good chance the port won't be in use by the time the OP tries to run lsof. It's not a stateful connection. In fact, a quick glance at my tcpdump output shows me four different source ports listed in the course of a second.

mazianni 2010-10-20 14:51:16

mazianni, you have understood the point. UDP is stateless so when i call lsof/netstat the port is not anymore used, as consequence i cant be able to see the PID of the process.

boos 2010-10-21 08:34:54

Answer 3

A:

Linux Socket Monitor can track changes to network sockets. It should alert you when new socket is opened.

Paweł 2010-10-20 20:39:09

Linux Socket Monitoring is only a bash script that call lsof/netstat. With this way, isnt possible to call it exactly when the udp traffic is generated.

boos 2010-10-21 08:35:20

ansaurus

tags:

views:

answers:

how i can identify which process is making UDP traffic on linux ?

related questions