So this may be more appropriate for serverfault, but it seems like it belongs here.

I was watching iftop on a server I control that can send data to arbitrary sources but can theoretically only receive traffic from other servers behind the reverse proxy. I noticed an odd URL that disappeared before I could tell if it was inbound or outbound, but it was definitely not one of my servers.

Is there a way to tell what program was communicating with a particular URL?


The good news is that it's possible it was logged somewhere on the system. I'd recommend searching all system logs you can during that time period for domain names, while excluding your domain from the search with grep or another similar tool. Here is a suggested starting point for a domain name regex if you're not familiar with them off-hand. I know that I'm not and always have to reference them: https://stackoverflow.com/questions/21172095/grep-valid-domain-regex .

Now for the bad news. If the system is compromised, the local logs could be tampered with or destroyed by an attacker. Also, there is a good chance that there is no record whatsoever on the system and never was. I'd suggest ensuring you have centralized logging if you don't already. Even if you do, I'd suggest reviewing your configuration to ensure you're capturing all the logs you expect. Also, I highly recommend you configure your services to connect through proxies or other mechanisms which log their connections.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.