7

After installing Conky and listing all my inbound and outbound connections I start to wonder what's actually happening and what and why things are happening.

screenshot

I'm getting a bit suspicious. How can I know which process is accessing which of these addresses?

dobey
  • 41,650
Qohelet
  • 737

3 Answers3

8

If you only want to see those connections that arouse your suspicion you can really use lsof.

sudo lsof -i | egrep -i "cloudfront|poneytelecom|dark"

lsof -i restricts the output to internet connections.
Use egrep (instead of grep) to be able to supply alternatives in the search string (separated by |), -i tells egrep to ignore case (DARK vs. dark).

If you have IP-addresses instead of hostnames use

sudo lsof -ni | egrep -i "10\.0\.8|193\.170"
guntbert
  • 13,475
2

My favorite tool dealing with processes and network usage is nethogs (install it with sudo apt-get install nethogs).

This tool displays every process and the bandwidth it consumes, it doesn't show the IP-addresses where the processes are connecting though. You may have to start it with the interface name, e.g. sudo nethogs wlan0.

enter image description here

guntbert
  • 13,475
1

You can run lsof -n|grep TCP to know which programs are connecting to which IPs.

dobey
  • 41,650