NetFilter
[Top] [All Lists]

Re: will --cmd-owner ever return?

To: Tom Eastep <teastep@shorewall.net>
Subject: Re: will --cmd-owner ever return?
From: tom <tom@t0mb.net>
Date: Tue, 27 Mar 2007 20:25:34 +0100
Cc: netfilter@lists.netfilter.org, vwf <vwf@vulkor.net>
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <460967CB.7020608@shorewall.net>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
References: <20070327184526.GA5168@trane.vulkor.net> <460967CB.7020608@shorewall.net>
Reply-to: tom@t0mb.net
Sender: netfilter-bounces@lists.netfilter.org
User-agent: Mail/News 1.5.0.10 (X11/20070318)
If a connection is established, then you can find the owner by comparing the inode in /proc/net/tcp with the /proc/<PID> tree [all the numbered folders]. In each of these there is a folder named fd which provides symbolic links to the open file descriptors which that PID is using. a quick ls -l will give you the information you need to resolve it to a socket inode, you'll usually see socket:[32424] or something similar. You then know which PID owns the conection. I have some python code which resolves this all to program names if you want it?

Tom Eastep wrote:
vwf wrote:

How can I lock my workstation down on application level?

tuxguardian.sf.net

-Tom



<Prev in Thread] Current Thread [Next in Thread>