I have a Centos 7 server running httpd for a webmail service. I'm blocking outgoing connections, including ports 80 and 443. I'm doing this with iptables on the machine.
Now looking at the logs I see the server is trying to make outgoing connections to ports 80 and 443.
--log-uid in iptables I was able to see that the user making those connections is
apache which is the user running httpd.
The connections occur at random times throughout the day and to about 50 different IP addresses on port 80 and more than double that on port 443.
How can I determine what process is making those connections?
And is there any way to determine what's going on without actually allowing those connections and capturing the traffic?