From owner-freebsd-isp@FreeBSD.ORG  Thu May 22 17:28:27 2003
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
Delivered-To: freebsd-isp@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AA7A737B401
	for <freebsd-isp@freebsd.org>; Thu, 22 May 2003 17:28:27 -0700 (PDT)
Received: from mail.munk.nu (213-152-51-194.dsl.eclipse.net.uk
	[213.152.51.194])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0A20243F85
	for <freebsd-isp@freebsd.org>; Thu, 22 May 2003 17:28:27 -0700 (PDT)
	(envelope-from munk@mail.munk.nu)
Received: from munk by mail.munk.nu with local (Exim 4.20)
	id 19J0Q5-000CMc-KA
	for freebsd-isp@freebsd.org; Fri, 23 May 2003 01:28:25 +0100
Date: Fri, 23 May 2003 01:28:25 +0100
From: Jez Hancock <jez.hancock@munk.nu>
To: freebsd-isp@freebsd.org
Message-ID: <20030523002825.GJ28372@users.munk.nu>
Mail-Followup-To: freebsd-isp@freebsd.org
References: <20030522112239.GB22219@users.munk.nu>
	<20030523092953.363eaab5.sgcccdc@citec.qld.gov.au>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030523092953.363eaab5.sgcccdc@citec.qld.gov.au>
User-Agent: Mutt/1.4.1i
Sender: User Munk <munk@mail.munk.nu>
Subject: Re: Determining what process/uid is attempting a network connection
X-BeenThere: freebsd-isp@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Internet Services Providers <freebsd-isp.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-isp>
List-Post: <mailto:freebsd-isp@freebsd.org>
List-Help: <mailto:freebsd-isp-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 23 May 2003 00:28:28 -0000

On Fri, May 23, 2003 at 09:29:53AM +1000, Colin Campbell wrote:
> > How can I determine what process is spawning this connection attempt and
> > the uid of the process?
> 
> Try "sockstat" or install "lsof".
Cheers, just trawled through the man page for lsof and never realized it
was so useful or had such an extensive array of filtering parameters.

lsof -i@0.0.13.5 -r10

should hopefully catch the problematic requests.

Thanks also to the others who responded in private.

Jez