13

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW):

sudo ufw deny out proto tcp to any port 1:65535

To                         Action      From
--                         ------      ----
1:65535/tcp                DENY OUT    Anywhere

Now I would like to use netstat to list only OUTBOUND tcp connections, not inbound. How can I do that?

MadHatter
  • 78,442
  • 20
  • 178
  • 229
David Coch
  • 131
  • 1
  • 1
  • 5

2 Answers2

17

netstat -nputw should do the trick. Add c for continuous updating.

Also, this may be more what you're looking for: https://askubuntu.com/questions/252179/how-to-inspect-outgoing-http-requests-of-a-single-application

Community
  • 1
RyanH
  • 327
  • 1
  • 6
8

If you only want outbound tcp connections, I think you can use

netstat -atn | tr -s ' '| cut -f5 -d ' ' | grep -v '127.0.0.1'

That will show all connections whose destination is not your localhost. You can add your internal ip, say

netstat -atn | tr -s ' '| cut -f5 -d ' ' | grep -v '127.0.0.1\|192.168.0.15'

MadHatter
  • 78,442
  • 20
  • 178
  • 229
sfault
  • 164
  • 7