I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the application calls ?
2 Answers
Linux
As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not.
netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every connection which was closed before or started after the execution of netstat will obviously not be shown.
A solution for this is to use strace which can help you monitor the connections which created by a process.
To start a process and monitor its connections:
strace -f -e trace=network -s 10000 <process [arg1] [arg2] [...]>
To monitor an already existing process:
strace -p <pid> -f -e trace=network -s 10000
if you don't know its PID use pidof <processname>
Then use some grep magic to print only the IP addresses:
strace -f -e trace=network <process [args...]> 2>&1 | grep -oP 'connect.*inet_addr\("\K[^"]+'
Windows
In windows you also can use netstat or the improved version of it Get-NetTCPConnection via powershell. But both have the blind spot aforementioned.
Two recommended solutions for it are:
- Network Monitor by Microsoft
- TcpLogView by Nirsoft
Both have the ability to monitor connections as they open and a nice GUI to show it.
-
Network Monitor just did what i needed, it first shown the source address as a "website" address, like "something.address1.net", but then searching on the information it gives when clicking on it, i managed to find the IP address and the port, and thats what i needed Aug 7, 2017 at 5:10
-
That was really helpful, i'm sure that i'll be using this software a lot from now on Aug 7, 2017 at 5:11
Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP.
On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports used for existing connections. If you want to list existing connections and their owning processes on linux, running the netstat command.
By providing it some command line arguments you can get the desired information, consulting man pages is always recommended but for your specific case running netstat -ape to list all connections with their pid and username.
-
1
-