Can you count the letter c in:
Q: How to log all remote destinations a networking process is exchanging data with? When a process is exchanging data over network, I can think of at least the following parameters:


*

*a remote host:port pair - it identifies the remote endpoint (theres also the local host:port pair, but the port is generally randomized for outgoing connections, so I dont need it)

*is it TCP or UDP traffic

*is it incoming or outgoing traffic


How can I log all this data for a certain process during its whole lifetime? I need this on Linux. Im not trying to block some traffic, just to log the above details.
As I understand, a network sniffer alone wont do it, since when an IP packet is coming from outside, the sniffer has no idea about which process the packet is for (since this is another layer, the application layer IIRC).

A: Im not sure if this could be usefull to you, but alternatives are:
1) if you know the process ID (PID):
 $ lsof -ni4 -p <PID>



*

*-n: numeric output (does not lookup host or port)

*-i4: internet files (open sockets), ipv4


This will show you only connections initiated from you host.
2) Another way is to use iptables with LOG target and module owner (-m owner). Something like:
# iptables -A OUTPUT -m owner <USER ID> -j LOG [ Some Tag ]
# iptables -A INPUT -p tcp --dport <SERVICE PORT> -j LOG [ Some Tag input ]
# iptables -A INPUT -p udp --dport <SERVICE PORT> -j LOG [ Some Tag input ]

You could grep your syslog for the specified tag. This approach does not allow you to specify a process id, but if it is a daemon that only runs this service, could be what you want.

A: If this is just for one process you could run the process under the control of strace and log the data. strace will show all of the system calls, and you can then postprocess all of the logs to see what your process was up to.

A: Check out tcpspy.  It should do what you want.  However, the homepage for the tool isnt currently responding, so you may have to look at it from FSFs listing or the Debians archive.
Heres the description:

tcpspy is an administrators tool that
  logs information about incoming and
  outgoing TCP/IP connections. Its
  written in C and uses no libpcap
  functions, unlike tcpdump.
Connections are selected for logging
  with rules, similarly to the filter
  expressions accepted by tcpdump. The
  following information is logged:
  username, local address and port,
  remote address and port, and,
  optionally, the executable filename.
At present, only the IPv4 protocol is
  supported.

Heres the relevant links:


*

*http://directory.fsf.org/project/tcpspy/

*http://packages.debian.org/sid/tcpspy
And heres the URL listed in the Debian package as the projects homepage:


*

*http://the.wiretapped.net/security/network-monitoring/tcpspy/

user
The text includes eighty-five "c"s in total.
assistant