View Single Post
Old 18th April 2012, 10:16
Ovidiu Ovidiu is offline
Senior Member
Join Date: Sep 2005
Posts: 1,269
Thanks: 84
Thanked 25 Times in 21 Posts
Default how to track or trace outgoing traffic

Since I installed apf firewall on my Debian squeeze server I see a lot of blocked outgoing traffic and it is rightfully blocked as my server should have no business connecting to this IP but I would really like to know who or what application is responsible for these connections.

Can someone point me in the right direction how to track this?

I see tons of these logs:

Apr 18 09:11:04 h1870666 kernel: [2406188.392117] ** SDROP ** IN= OUT=eth0 SRC= DST= LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=48286 DF PROTO=TCP SPT=53254 DPT=80 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B401010402)
Reply With Quote
Sponsored Links