I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the application calls ?
As @Nirlzr correctly mentioned,
netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not.
netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every connection which was closed before or started after the execution of
netstat will obviously not be shown.
A solution for this is to use
strace which can help you monitor the connections which created by a process.
To start a process and monitor its connections:
strace -f -e trace=network -s 10000 <process [arg1] [arg2] [...]>
To monitor an already existing process:
strace -p <pid> -f -e trace=network -s 10000
if you don't know its PID use
Then use some
grep magic to print only the IP addresses:
strace -f -e trace=network <process [args...]> 2>&1 | grep -oP 'connect.*inet_addr\("\K[^"]+'
In windows you also can use
netstat or the improved version of it
powershell. But both have the blind spot aforementioned.
Two recommended solutions for it are:
Both have the ability to monitor connections as they open and a nice GUI to show it.
Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP.
On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports used for existing connections. If you want to list existing connections and their owning processes on linux, running the
By providing it some command line arguments you can get the desired information, consulting man pages is always recommended but for your specific case running
netstat -ape to list all connections with their pid and username.