I have a task to monitor outbound connections from productio

Question

I have a task to monitor outbound connections from production environments One item that keeps showing up is `sudo ls proc 12345 fd` where 12345 is a process ID Why is this command considered an outbound connection

seph · Answer

What query are you running

Zlexis · Answer

`SELECT user username proc name hash md5 socket pid proc path proc cmdline socket local port socket remote port socket remote address FROM process open sockets as socket processes as proc users as user hash as hash where socket local port not in select port from listening ports and socket local port = 0 and socket pid = proc pid and user uid = proc uid and hash path = proc path `

seph · Answer

It would not surprise me if sudo did something that looked like a socket That table is more than just network sockets If things change fast you ll see a race condition for pid reuse

Zlexis · Answer

Is there a qualifier in the process open sockets table that indicates whether it is a network socket I don t have access to the box to manually query it

seph · Answer

Both `process open sockets` and `listening ports` have columns for family The meaning there is os dependent