3

In Wireshark, on the loopback interface, I can see SYN requests from localhost to closed ports on localhost that are being responded to with RST, ACKS.

I'm curious what's generating the traffic. How can I find out?

I can't use netstat because the connections aren't held open. lsof -i :[port-range] doesn't show any results either.

2

The problem with tools like netstat, ss and lsof is that these work on snapshots of the network state. Connections that are reset during the setup will not show up with high probability.

While Wireshark can capture the TCP packets, it will not be able to tell the process ID that was responsible for it. This information is not provided in a normal Ethernet capture. There is a different mechanism (NFLOG) that can log packets as seen by Netfilter (iptables), but this may at most contain the User ID of the process that generated a packet.

One approach to tackle the issue is by stalling or completely dropping network traffic.

  1. Using Wireshark, you could for example determine that the port range is within 5037-5585.
  2. Add a new firewall rule that drops newly initiated TCP traffic to the loopback interface for that port range:

    sudo iptables -I INPUT -p tcp -i lo --dport 5037:5585 --syn -j DROP
    
  3. Now you can use netstat, ss, etc. to find the offending program. For example:

    sudo ss -tapn | grep '5[0-5]'
    
  4. When done, remove the firewall rule again such that new connections can occur:

    sudo iptables -D INPUT -p tcp -i lo --dport 5037:5585 --syn -j DROP
    

I used this approach to identify that the ADB daemon was trying to connect all the time to some local ports, presumably to locate an Android simulator.

0

If you're on Windows you can use procmon and TCPview tools to monitor which processes are connecting to which destinations:

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx https://technet.microsoft.com/en-us/sysinternals/tcpview

On Linux same functionality can be achieved by using:

ps and netstat, and by closing firewall and logging dropped packets with iptables and watching for connections with multitail

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.