Network traffic and port analysis

Every application that accesses the network does it via a port. Listing the open ports, the application using a port and the user running the application is a way to track the expected and unexpected uses of your system. This information can be used to allocate resources as well as checking for rootkits or other malware.

Getting ready

Various commands are available for listing ports and services running on a network node. The lsof and netstat commands are available on most GNU/Linux distributions.

How to do it...

The lsof (list open files) command will list open files. The -i option limits it to open network connections:

$ lsof -i 
COMMAND    PID   USER   FD   TYPE DEVICE SIZE/OFF NODE 
    NAME

firefox-b 2261 slynux   78u  IPv4  63729      0t0  TCP 
    localhost:47797->localhost:42486 (ESTABLISHED)

firefox-b 2261 slynux   80u  IPv4  68270      0t0  TCP 
    slynux-laptop.local:41204->192.168.0.2:3128 (CLOSE_WAIT)

firefox-b 2261 slynux   82u  IPv4 ...