2

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the application calls ?

6

Linux

As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not.

netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every connection which was closed before or started after the execution of netstat will obviously not be shown.

A solution for this is to use strace which can help you monitor the connections which created by a process.

To start a process and monitor its connections:
strace -f -e trace=network -s 10000 <process [arg1] [arg2] [...]>

To monitor an already existing process:
strace -p <pid> -f -e trace=network -s 10000
if you don't know its PID use pidof <processname>

Then use some grep magic to print only the IP addresses:
strace -f -e trace=network <process [args...]> 2>&1 | grep -oP 'connect.*inet_addr\("\K[^"]+'


Windows

In windows you also can use netstat or the improved version of it Get-NetTCPConnection via powershell. But both have the blind spot aforementioned.

Two recommended solutions for it are:

Both have the ability to monitor connections as they open and a nice GUI to show it.

  • Network Monitor just did what i needed, it first shown the source address as a "website" address, like "something.address1.net", but then searching on the information it gives when clicking on it, i managed to find the IP address and the port, and thats what i needed – Bruno Cerk Aug 7 '17 at 5:10
  • That was really helpful, i'm sure that i'll be using this software a lot from now on – Bruno Cerk Aug 7 '17 at 5:11
1

Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP.

On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports used for existing connections. If you want to list existing connections and their owning processes on linux, running the netstat command.

By providing it some command line arguments you can get the desired information, consulting man pages is always recommended but for your specific case running netstat -ape to list all connections with their pid and username.

  • 1
    On windows, it is netstat -n -b – Y M Aug 4 '17 at 17:33
  • Its Windows, but thanks very much, i'll look into it – Bruno Cerk Aug 4 '17 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.