Re: [gentoo-user] Strange outbound requests

[Michael Orlitzky]

On 01/20/2012 07:12 PM, Grant wrote:
>>> If the machine is running linux, then 'watch "lsof -n|grep TCP|grep
>>> 3680"' as root is a sloppy but effective way to find it. There's
>>> probably some way to set up a firewall rule on the host in question
>>> that logs out the user and (possibly) PID of the connection, but I
>>> don't know.
>>
>> "lsof -i" is easier, it only shows network connections :)
>>
>> catching it when it happens (if it is very briefly connected) could be
>> hard with lsof... Maybe setup a tarpit firewall rule on that box so
>> the connection stays open for a long time.
>
> The connections are only attempted a few times throughout the day.  Is
> a tarpit firewall rule the only way to do this?  Can anyone tell me
> what package 'watch' belongs to if that would work?
>

`watch` isn't going to help too much unless you're looking at it. Append 
the output to some log file instead. I chose netstat because its output 
looked easier to parse with a stupid regexp.

   while true; do
     netstat -antp | grep ':993 ' >> mystery.log;
     sleep 1;
   done;

You'll want to change the port -- I tested to make sure that was really 
logging my Thunderbird connections.