除了一个空的终端窗口和系统监视器外，没有打开任何程序，我可以看到网络流量。大约每隔 1 秒钟，出站流量和入站流量就会出现一个小高峰。$ sudo tcpdump -vv -A显示对随机 IP 的几乎持续轮询。下面包含 netstat 和 tcpdump 的片段。空闲时，CPU 使用率非常低，RAM 使用率没有什么突出的。我如何找到发起此流量的进程以确保它们是合法的和/或删除它们？
Stackoverflow 将输入限制为 30000 个字符，因此我截断或删除了 netstat/tcpdump/ps 的输出，并将很快发布链接版本。
我正在运行 postgres 和 tor（5432/9050）。
$ uname -a
Linux localhost.localdomain 5.9.11-100.fc32.x86_64 #1 SMP Tue Nov 24 19:16:53 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
$ netstat -avnp
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN -
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9050 0.0.0.0:* LISTEN -
tcp 0 0 192.168.43.5:59018 82.165.103.72:443 ESTABLISHED -
tcp6 0 0 :::3306 :::* LISTEN -
tcp6 0 0 :::111 :::* LISTEN -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::5298 :::* LISTEN 11406/telepathy-sal
tcp6 0 0 ::1:631 :::* LISTEN -
tcp6 0 0 :::443 :::* LISTEN -
netstat: no support for `AF INET (sctp)' on this system.
netstat: no support for `AF INET (sctp)' on this system.
udp 0 0 0.0.0.0:52467 0.0.0.0:* -
udp 0 0 127.0.0.1:36654 127.0.0.1:36654 ESTABLISHED -
udp 0 0 0.0.0.0:5353 0.0.0.0:* -
udp 0 0 192.168.122.1:53 0.0.0.0:* -
udp 0 0 0.0.0.0:67 0.0.0.0:* -
udp 0 0 192.168.43.5:68 192.168.43.1:67 ESTABLISHED -
udp 0 0 0.0.0.0:111 0.0.0.0:* -
udp 0 0 127.0.0.1:323 0.0.0.0:* -
udp6 0 0 :::52486 :::* -
udp6 0 0 :::5353 :::* -
udp6 0 0 :::111 :::* -
udp6 0 0 ::1:323 :::* -
raw6 0 0 :::58 :::* 7 -
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 2 [ ACC ] STREAM LISTENING 67663 - @/tmp/dbus-pKviT04I
unix 2 [ ACC ] STREAM LISTENING 53227 - @/tmp/.ICE-unix/8573
unix 2 [ ACC ] STREAM LISTENING 67816 9768/gnome-session- @/tmp/.ICE-unix/9768
unix 2 [ ] DGRAM 66631 9477/systemd /run/user/1000/systemd/notify
unix 2 [ ] DGRAM 51406 - /run/user/42/systemd/notify
unix 2 [ ACC ] STREAM LISTENING 66634 9477/systemd /run/user/1000/systemd/private
unix 2 [ ACC ] STREAM LISTENING 51409 - /run/user/42/systemd/private
unix 2 [ ACC ] STREAM LISTENING 66641 9477/systemd /run/user/1000/bus
unix 2 [ ACC ] STREAM LISTENING 51418 - /run/user/42/bus
unix 2 [ ACC ] STREAM LISTENING 66642 9477/systemd /run/user/1000/pipewire-0
unix 2 [ ACC ] STREAM LISTENING 51419 - /run/user/42/pipewire-0
unix 2 [ ACC ] STREAM LISTENING 66643 9477/systemd /run/user/1000/pulse/native
unix 2 [ ACC ] STREAM LISTENING 51420 - /run/user/42/pulse/native
unix 2 [ ACC ] STREAM LISTENING 66644 9477/systemd /run/user/1000/snapd-session-agent.socket
unix 2 [ ACC ] STREAM LISTENING 51421 - /run/user/42/snapd-session-agent.socket
unix 2 [ ACC ] STREAM LISTENING 66160 - /run/user/1000/keyring/control
unix 2 [ ACC ] STREAM LISTENING 52894 - @/tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 63365 9508/Xorg @/tmp/.X11-unix/X1
unix 2 [ ACC ] STREAM LISTENING 46547 - /tmp/.s.PGSQL.5432
unix 3 [ ] DGRAM 1331 - /run/systemd/notify
unix 2 [ ACC ] STREAM LISTENING 40772 - @irqbalance7670.sock
unix 2 [ ] DGRAM 42543 - /var/run/chrony/chronyd.sock
unix 2 [ ACC ] STREAM LISTENING 67857 - /run/user/1000/keyring/pkcs11
unix 2 [ ACC ] STREAM LISTENING 67860 - /run/user/1000/keyring/ssh
unix 25 [ ] DGRAM 1343 - /run/systemd/journal/dev-log
unix 2 [ ACC ] STREAM LISTENING 1345 - /run/systemd/journal/stdout
unix 17 [ ] DGRAM 1347 - /run/systemd/journal/socket
unix 2 [ ACC ] STREAM LISTENING 52895 - /tmp/.X11-unix/X0
unix 2 [ ] DGRAM 42554 - /run/systemd/home/notify
unix 2 [ ACC ] STREAM LISTENING 42556 - /run/systemd/userdb/io.systemd.Home
unix 2 [ ACC ] STREAM LISTENING 53228 - /tmp/.ICE-unix/8573
unix 2 [ ACC ] STREAM LISTENING 44662 - @/tmp/dbus-BLXNiJvO
unix 2 [ ACC ] STREAM LISTENING 63366 9508/Xorg /tmp/.X11-unix/X1
unix 2 [ ACC ] STREAM LISTENING 40909 - /var/run/mcelog-client
unix 2 [ ACC ] STREAM LISTENING 63471 - /tmp/ssh-jxgRTFKssaxH/agent.9522
unix 2 [ ACC ] STREAM LISTENING 67817 9768/gnome-session- /tmp/.ICE-unix/9768
unix 2 [ ACC ] STREAM LISTENING 66417 9766/pulseaudio /tmp/.esd-1000/socket
unix 2 [ ACC ] STREAM LISTENING 36320 - @ISCSID_UIP_ABSTRACT_NAMESPACE
unix 2 [ ACC ] STREAM LISTENING 42933 - /var/run/abrt/abrt.socket
unix 2 [ ] DGRAM 511876 - @userdb-0bee4a4179405db591eb1f23b10b2ef5
unix 2 [ ACC ] STREAM LISTENING 46190 - /var/lib/gssproxy/default.sock
unix 2 [ ACC ] STREAM LISTENING 44663 - @/tmp/dbus-ahGNYpqL
unix 2 [ ACC ] STREAM LISTENING 46191 - /run/gssproxy.sock
unix 2 [ ACC ] STREAM LISTENING 67092 9812/ibus-daemon @/home/dave/.cache/ibus/dbus-i8FrV8PD
unix 2 [ ACC ] STREAM LISTENING 48210 - /var/lib/mysql/mysql.sock
unix 2 [ ACC ] STREAM LISTENING 57485 - @/var/lib/gdm/.cache/ibus/dbus-DKte3KoP
unix 2 [ ACC ] STREAM LISTENING 31759 - /run/systemd/private
unix 2 [ ACC ] STREAM LISTENING 31761 - /run/systemd/userdb/io.systemd.DynamicUser
unix 2 [ ACC ] STREAM LISTENING 46546 - /var/run/postgresql/.s.PGSQL.5432
unix 2 [ ACC ] STREAM LISTENING 67662 - @/tmp/dbus-IIRpKdPq
unix 2 [ ACC ] STREAM LISTENING 82818 11081/gpg-agent /run/user/1000/gnupg/S.gpg-agent
unix 2 [ ACC ] STREAM LISTENING 82819 11081/gpg-agent /run/user/1000/gnupg/S.gpg-agent.extra
unix 2 [ ACC ] STREAM LISTENING 31775 - /run/lvm/lvmpolld.socket
unix 2 [ ACC ] STREAM LISTENING 82820 11081/gpg-agent /run/user/1000/gnupg/S.gpg-agent.browser
unix 2 [ ACC ] STREAM LISTENING 30928 - /run/rpcbind.sock
unix 2 [ ACC ] STREAM LISTENING 82821 11081/gpg-agent /run/user/1000/gnupg/S.gpg-agent.ssh
unix 2 [ ACC ] SEQPACKET LISTENING 30938 - /run/systemd/coredump
unix 2 [ ACC ] SEQPACKET LISTENING 30939 - /run/udev/control
unix 2 [ ACC ] STREAM LISTENING 30941 - /run/systemd/userdb/io.systemd.Multiplexer
unix 2 [ ACC ] STREAM LISTENING 44660 - @/tmp/dbus-hAFg9qTn
unix 2 [ ACC ] STREAM LISTENING 46599 - /run/php-fpm/www.sock
unix 2 [ ACC ] STREAM LISTENING 46783 - /run/tor/control
unix 2 [ ACC ] STREAM LISTENING 36319 - @ISCSIADM_ABSTRACT_NAMESPACE
unix 2 [ ACC ] STREAM LISTENING 32933 - /run/systemd/journal/io.systemd.journal
unix 2 [ ] DGRAM 512559 - @userdb-8500a1c0a265cfbe91b58a45b58a3bde
unix 2 [ ] DGRAM 511808 - @userdb-1b21fdefb8bd190f692ad71a7eef8350
unix 2 [ ACC ] STREAM LISTENING 53938 - @/tmp/dbus-3NH5zvD2zn
unix 2 [ ACC ] STREAM LISTENING 36313 - /run/avahi-daemon/socket
unix 2 [ ACC ] STREAM LISTENING 44661 - @/tmp/dbus-j9jAEHL8
unix 2 [ ACC ] STREAM LISTENING 36315 - /run/cups/cups.sock
unix 2 [ ACC ] STREAM LISTENING 36317 - /run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 36321 - /run/libvirt/libvirt-sock
unix 2 [ ACC ] STREAM LISTENING 36323 - /run/libvirt/libvirt-admin-sock
unix 3 [ ] STREAM CONNECTED 57165 - /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 58014 - /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 52132 -
unix 3 [ ] STREAM CONNECTED 54625 -
unix 2 [ ] DGRAM 43076 -
unix 3 [ ] STREAM CONNECTED 36583 -
unix 3 [ ] STREAM CONNECTED 95305 11524/seahorse
unix 3 [ ] STREAM CONNECTED 71114 10046/gsd-usb-prote
unix 3 [ ] STREAM CONNECTED 66528 9756/dbus-broker @00747
unix 3 [ ] STREAM CONNECTED 67097 9520/dbus-broker /run/user/1000/bus
unix 3 [ ] STREAM CONNECTED 42819 -
netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.
Active Bluetooth connections (servers and established)
Proto Destination Source State PSM DCID SCID IMTU OMTU Security
netstat: no support for `BTPROTO L2CAP' on this system.
Proto Destination Source State Channel
netstat: no support for `BTPROTO RFCOMM' on this system.
$ sudo tcpdump -vv -A
[sudo] password for dave:
dropped privs to tcpdump
tcpdump: listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes
09:52:49.221170 IP (tos 0x0, ttl 55, id 5217, offset 0, flags [none], proto TCP (6), length 125)
den02s01-in-f3.1e100.net.https > localhost.localdomain.33710: Flags [P.], cksum 0xff90 (correct), seq 413833741:413833814, ack 3161770310, win 315, options [nop,nop,TS val 2204560950 ecr 514379669], length 73
E..}.a..7.........+..........t.F...;.......
.f.6........Dgch).y".ox.,...U..h........Djj....r.!.R.oJzI/..$.?LA.Z........d9z...
09:52:49.221543 IP (tos 0x0, ttl 64, id 12057, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.33710 > den02s01-in-f3.1e100.net.https: Flags [F.], cksum 0x08c6 (correct), seq 1, ack 73, win 501, options [nop,nop,TS val 514619688 ecr 2204560950], length 0
E..4/.@[email protected]..+..........t.F...V...........
..y(.f.6
09:52:49.225340 IP (tos 0x0, ttl 64, id 5439, offset 0, flags [DF], proto UDP (17), length 71)
localhost.localdomain.42495 > _gateway.domain: [udp sum ok] 21145+ PTR? 5.43.168.192.in-addr.arpa. (43)
E..G.?@[email protected]...+...+....5.3.oR............5.43.168.192.in-addr.arpa.....
09:52:49.227321 IP (tos 0x0, ttl 64, id 46153, offset 0, flags [DF], proto UDP (17), length 71)
_gateway.domain > localhost.localdomain.42495: [udp sum ok] 21145 NXDomain q: PTR? 5.43.168.192.in-addr.arpa. 0/0/0 (43)
E..G.I@.@.....+...+..5...3^.R............5.43.168.192.in-addr.arpa.....
09:52:49.231085 IP (tos 0x0, ttl 64, id 5442, offset 0, flags [DF], proto UDP (17), length 73)
localhost.localdomain.40310 > _gateway.domain: [udp sum ok] 53024+ PTR? 227.11.217.172.in-addr.arpa. (45)
E..I.B@[email protected]...+...+..v.5.59C. ...........227.11.217.172.in-addr.arpa.....
09:52:49.265963 IP (tos 0x0, ttl 64, id 46157, offset 0, flags [DF], proto UDP (17), length 111)
_gateway.domain > localhost.localdomain.40310: [udp sum ok] 53024 q: PTR? 227.11.217.172.in-addr.arpa. 1/0/0 227.11.217.172.in-addr.arpa. PTR den02s01-in-f3.1e100.net. (83)
E..o.M@.@.....+...+..5.v.[... ...........227.11.217.172.in-addr.arpa.............5....den02s01-in-f3.1e100.net.
09:52:49.271587 IP (tos 0x0, ttl 64, id 5463, offset 0, flags [DF], proto UDP (17), length 71)
localhost.localdomain.33612 > _gateway.domain: [udp sum ok] 63879+ PTR? 1.43.168.192.in-addr.arpa. (43)
E..G.W@[email protected]...+...+..L.5.3[8.............1.43.168.192.in-addr.arpa.....
09:52:49.273258 IP (tos 0x0, ttl 64, id 46158, offset 0, flags [DF], proto UDP (17), length 71)
_gateway.domain > localhost.localdomain.33612: [udp sum ok] 63879 NXDomain q: PTR? 1.43.168.192.in-addr.arpa. 0/0/0 (43)
E..G.N@.@.....+...+..5.L.3...............1.43.168.192.in-addr.arpa.....
09:52:49.289081 IP (tos 0x0, ttl 55, id 5242, offset 0, flags [none], proto TCP (6), length 52)
den02s01-in-f3.1e100.net.https > localhost.localdomain.33710: Flags [F.], cksum 0x0928 (correct), seq 73, ack 2, win 315, options [nop,nop,TS val 2204561037 ecr 514619688], length 0
E..4.z..7.........+........V.t.G...; (.....
.f....y(
09:52:49.289168 IP (tos 0x0, ttl 64, id 12058, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.33710 > den02s01-in-f3.1e100.net.https: Flags [.], cksum 0x082a (correct), seq 2, ack 74, win 501, options [nop,nop,TS val 514619756 ecr 2204561037], length 0
E..4/.@[email protected]@..+..........t.G...W.....*.....
..yl.f..
09:52:52.994807 IP (tos 0x0, ttl 44, id 52683, offset 0, flags [DF], proto TCP (6), length 588)
82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0xa3b8 (correct), seq 347695786:347696322, ack 4205776962, win 501, options [nop,nop,TS val 4039827458 ecr 1207355784], length 536
E..L..@.,..ER.gH..+.......j....B...........
....G........{-.5v.&.....g....t&.k....@.&p:.{...A.;....._Z..
....A...s.|.........z.S.n.1.,..c.. ....]...f...BA.@m&....a:\1...Xz.+.,.........P^ }X.T..K . ..L....V. n....X... .0....s...... :.RH.M.(...2..$.?9....>G.)5)06..$...._:<.Nz2Zq..^.&.w.........f..../....*G..FF$N*.RfL..(?.F...H..... ..*Y.....,.i.@..%.f>......@..(O....m.}i.}...<...8.'..:[email protected]..+.e.; f.....GAZ.n....n-.x^".afsR...%..e...3.9.a.......R...r...
!.. .z..\s..".............}%..?.:.`..GA7..T.kM...2......xx......'..-mJ...e.....p.......VRO;+.......5.w{..L.b%..Jv........`....T
09:52:52.994941 IP (tos 0x0, ttl 64, id 38645, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x5f9e (correct), seq 1, ack 536, win 762, options [nop,nop,TS val 1207361810 ecr 4039827458], length 0
E..4..@[email protected]..+.R.gH.......B..l....._......
G.......
09:52:53.001866 IP (tos 0x0, ttl 64, id 6726, offset 0, flags [DF], proto UDP (17), length 72)
localhost.localdomain.34678 > _gateway.domain: [udp sum ok] 43806+ PTR? 72.103.165.82.in-addr.arpa. (44)
E..H.F@[email protected]...+...+..v.5.4.?.............72.103.165.82.in-addr.arpa.....
09:52:53.006443 IP (tos 0x0, ttl 64, id 46924, offset 0, flags [DF], proto UDP (17), length 72)
_gateway.domain > localhost.localdomain.34678: [udp sum ok] 43806 NXDomain q: PTR? 72.103.165.82.in-addr.arpa. 0/0/0 (44)
E..H.L@.@.....+...+..5.v.4)..............72.103.165.82.in-addr.arpa.....
09:52:59.715841 IP (tos 0x0, ttl 44, id 52684, offset 0, flags [DF], proto TCP (6), length 588)
82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0x0289 (correct), seq 536:1072, ack 1, win 501, options [nop,nop,TS val 4039834165 ecr 1207361810], length 536
E..L..@.,..DR.gH..+.......l....B...........
...5G......... .-Zw=.6#802...V
`G..a.WRT.<..........,.wtl\...48Zl....6.i..e.g.dL...S...|L>oN.\..4..z.z.7"a...'zA.Z....7+?Q....Y.?'Bcu.#.%.D....:.,..."....3...W.D2.Y8..8..+.........Ue..>l..........3.0.4.tcLe..Q....Oy..e....B./U5..jh.....Gdv..K....n...i.z............V[F.J.C..Z~F..J
e.e^>
.w*.0g........C+.y?...._.....5(.....I..7-............'4.X.s..;.<p.2r.q.....C.r..C{.q...LA.....9g...HI...3..A......
cN1..:.%@...Kt{......
8c..%..N."...6..G....lX...v...f.0..9...S`n/G....J...>.G..o...{u...I........+...e.p.....-................G....v...Tn...T.
09:52:59.715967 IP (tos 0x0, ttl 64, id 38646, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x2912 (correct), seq 1, ack 1072, win 762, options [nop,nop,TS val 1207368531 ecr 4039834165], length 0
E..4..@[email protected]..+.R.gH.......B..n.....)......
G..S...5
09:53:01.331562 IP (tos 0x0, ttl 64, id 42377, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.58794 > den02s02-in-f14.1e100.net.https: Flags [.], cksum 0x9c11 (correct), seq 941105926, ack 2407933939, win 501, options [nop,nop,TS val 3918337418 ecr 796134296], length 0
E..4..@.@.....+.........8.#...'............
..../t..
09:53:01.338695 IP (tos 0x0, ttl 64, id 6950, offset 0, flags [DF], proto UDP (17), length 72)
localhost.localdomain.47838 > _gateway.domain: [udp sum ok] 11291+ PTR? 14.12.217.172.in-addr.arpa. (44)
E..H.&@[email protected](..+...+....5.4V.,............14.12.217.172.in-addr.arpa.....
09:53:01.395143 IP (tos 0x0, ttl 64, id 48250, offset 0, flags [DF], proto UDP (17), length 111)
_gateway.domain > localhost.localdomain.47838: [udp sum ok] 11291 q: PTR? 14.12.217.172.in-addr.arpa. 1/0/0 14.12.217.172.in-addr.arpa. PTR den02s02-in-f14.1e100.net. (83)
E..o.z@.@.....+...+..5...[..,............14.12.217.172.in-addr.arpa..................den02s02-in-f14.1e100.net.
09:53:01.399966 IP (tos 0x0, ttl 118, id 63042, offset 0, flags [none], proto TCP (6), length 52)
den02s02-in-f14.1e100.net.https > localhost.localdomain.58794: Flags [.], cksum 0x9cf8 (correct), seq 1, ack 1, win 269, options [nop,nop,TS val 796181908 ecr 3918289806], length 0
E..4.B..v.........+.......'.8.#............
/t....[.
09:53:02.151026 IP (tos 0x0, ttl 44, id 52685, offset 0, flags [DF], proto TCP (6), length 588)
82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0x249d (correct), seq 1072:1608, ack 1, win 501, options [nop,nop,TS val 4039836587 ecr 1207368531], length 536
E..L..@.,..CR.gH..+.......n....B....$......
....G..S.......}{.'..F ....w.#;X....a..7.2..&......S.i./.#. .df...Y..M.+.....O......Q.. .6{....Q1J...7,..C.s..kY.=....?.h(....(..2Q...r.S...4.G3.}....^s....k.x&.....wk..MHms.g.h.......V..........Vx...b..^C.....E..mD..V.7f8YE..q#.T.V..,T....t/.......Y...... .tf`.Ld..?6'...S<0.q_u..#.tO38.... ....g.~..&r$5sXo.a.....:H...L.7 ....>h.q=..u.n|.S.......h...A}%.1...+l.......-...VWU*.<.....a.[ .O.fJ.M ...
..7.3paz.+......-.r...}..G. |.7....1^.z..F...... [email protected].#.H.-d...E)....1..........E.N[.q.D1..3..}..]..e.l.l.>)j.4.q.....x...D..h}....
09:53:02.151147 IP (tos 0x0, ttl 64, id 38647, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x1401 (correct), seq 1, ack 1608, win 762, options [nop,nop,TS val 1207370966 ecr 4039836587], length 0
E..4..@[email protected]..+.R.gH.......B..p............
G.......
09:53:04.643208 IP (tos 0x0, ttl 64, id 38648, offset 0, flags [DF], proto TCP (6), length 1394)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x33b0 (correct), seq 1:1343, ack 1608, win 762, options [nop,nop,TS val 1207373458 ecr 4039836587], length 1342
E..r..@.@.....+.R.gH.......B..p.....3......
G.............r. ..'...N?1...q...EK>g.. .....v...u...=5....rDZpq...m....|....3...1o.Zs.k....6.....kQ....bw...J.~i..Q.......a.C.T^.en..eF<.>.d.Of1.5.l........^.,..<r.....i.......B3......W:..\...I.....}..j.......q.fctG...R.9..c. Fx..9..q..&..._..z.KP.R..)..-7M.c...b........(].........!_...IG....=B.{jmH....XUB
5.qfV..p ..Z.......@.............'e.... .^..!"..[L...&r-.....).q..|r.yO.w.xxhh...............~.b..o.. ......h:@.P.....J..j... `...............w...m.'..._t.w..K..#...^m .G.m..e...89..!........... ...".
a._..#...2..Y.....\..S3&.<.mkz..8...Fn=[H.$.R.HI..YB.@H.=K.U...t....a b.vK...9.g.V....q.Q<.3.2.8......g.V....O..y1.:.VR..O....ks~Qq....
.:.y. ..$.U...F.....O..3o-./.~._y.P..D...;...Z......G..#!-...!...............P.#<....%...+../......A(.BU .....c.!..........~#.&zc...z..K.a.^........nO,...On;yT)...q...>G..v|c}.d.f...a.N.5..E......_.|..k.l......:........z-r.......Nap....>.9?.5#C..5f.t.....l..."J_.n.....lY..v..$hej.*}...cj......$.5........S/.!.D."uW..t.M..!et......{_?0+U...s..K.q).Igr.....\..,......V....A.....7.....bE.w[11."..:..i.Gz...xZv..U%...-<~.Y6eJ.:p.,....W..,......sk>1J.!"9..]..Z$....Z.._....{@.F..-..L8.z...u..v..3Q..)>s.......\...1.....]...'f.w.3...vK...... ..c0...}..S.p.|..<g%&...4!.[h)..T....F....J%.... ...c...B.....`....."..,..\tHyz|..8SD..}........+h...=Z..J..E..%t.K>....K.(..26.......... ....M.T..c2f}.P.t+. ..R...S.i
09:53:04.643260 IP (tos 0x0, ttl 64, id 38649, offset 0, flags [DF], proto TCP (6), length 788)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [P.], cksum 0xfa89 (correct), seq 1343:2079, ack 1608, win 762, options [nop,nop,TS val 1207373458 ecr 4039836587], length 736
E.....@[email protected]..+.R.gH..........p............
G..........dg.qf...5k..[....uw.s.......E..s...?'..*.D..'[email protected].}...g.l.'.B}.Tf.k.D) ..!+I.......p...|...+R*>.....c%M>.;...........l. O..0..w`.$=.u.7.s.....Xr....-.U.:..;...^...F.U"YN]....&...:B\W.W.....a...^..v+.......k_......o.....fp...tKw.[&.-O....'.0./...DMk...#.9A_8. (.... ..o.[-..m.........p.X.....LQ4M.0....B~..........%....%.9.uXi..1...p.7PC.c..~.k.xzr.....t0.D..e@QhU.... ...K.,1...dO......W.hW.C.s....(.^.b6.........E.6]..^...c..QY.%.cs...,. .kj.......'.".th\b..O.B.........'.jv..5..'4 .^...v6...d.u.......C.........|..^w.../))..|....<i....H1..e.(.....
.>.L....9....D].~.n<...G].20.R,Q..=&..y...W+.......x.&.b....5.........o+...Y. .Y........AW M*.e.4`..T........G..:f.s..T...C....3$.!....l..eU....K..P...)..a..`.T.&~W.
09:53:04.731655 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has localhost.localdomain tell _gateway, length 28
...........KL...+.........+.
09:53:04.731705 ARP, Ethernet (len 6), IPv4 (len 4), Reply localhost.localdomain is-at 10:0b:a9:4e:f4:48 (oui Unknown), length 28
...........N.H..+....KL...+.
09:53:04.847887 IP (tos 0x0, ttl 44, id 52686, offset 0, flags [DF], proto TCP (6), length 52)
82.165.103.72.https > localhost.localdomain.59018: Flags [.], cksum 0xfb5f (correct), seq 1608, ack 1343, win 501, options [nop,nop,TS val 4039839319 ecr 1207373458], length 0
E..4..@.,..ZR.gH..+.......p.........._.....
...WG...
09:53:04.848003 IP (tos 0x0, ttl 44, id 52687, offset 0, flags [DF], proto TCP (6), length 52)
82.165.103.72.https > localhost.localdomain.59018: Flags [.], cksum 0xf884 (correct), seq 1608, ack 2079, win 496, options [nop,nop,TS val 4039839319 ecr 1207373458], length 0
E..4..@.,..YR.gH..+.......p....`...........
...WG...
09:53:04.857146 IP (tos 0x0, ttl 44, id 52688, offset 0, flags [DF], proto TCP (6), length 588)
82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0xaf5b (correct), seq 1608:2144, ack 2079, win 501, options [nop,nop,TS val 4039839328 ecr 1207373458], length 536
E..L..@.,[email protected]..+.......p....`.....[.....
...`G.........F..5H......%.......=.^0. ..U...P.EQ..,Ru.<..48.k...HI.X~...
0.0F6;]...I4-..qP../..|."...@.}o.k.../.!C.c.....!.......z..e"AJ..?`...: ..x.n..8o.<*J.f<..NW.....f.~....XS..
.Iwf..~...Y..D2.Y.b.`......:q....ZG...=......2....$......S..F...6..A..Q_s..Z).*..._.b&.`.....R;.r...!_-`...Nf/...7..%+.'.....p......K.].PB......H................m......Ij.F|...K...*A.......|.UyP...~;..}..}WB%{+..g
. V"..........%..-......Z..\H.....'=..P...9..[...|v..y...V.....R...I...L...Y.....I......K.....:..o..>7....Z......j..;....b.W...6.c9g....J1e..l.h3-.
09:53:04.857263 IP (tos 0x0, ttl 64, id 38650, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0xf483 (correct), seq 2079, ack 2144, win 762, options [nop,nop,TS val 1207373672 ecr 4039839328], length 0
E..4..@.@.....+.R.gH.......`..s
...........
G..h...`
09:53:04.858672 IP (tos 0x0, ttl 64, id 38651, offset 0, flags [DF], proto TCP (6), length 588)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [P.], cksum 0xd966 (correct), seq 2079:2615, ack 2144, win 762, options [nop,nop,TS val 1207373674 ecr 4039839328], length 536
E..L..@.@.....+.R.gH.......`..s
.....f.....
G..j...`.......w...Pa.. -...8....i..+8.na..5.d..)...qMU.........L..~.k...5......L4...../.;....,......<.Q.].(Nl.O.N..zD...}..6....U../\.g.....Y....!n.u..`..A...zc.....[..E.......x....(.'..W.$..............r..........C...~ <....LL..G.`..;.z|.......qBAm%Nf..Gt..m.....2..u...L....lG..A..lC..b.X&.....(..#.Q....T.{`.:..{.e
...!$.'.(<&v......d..Qb.."b.#......~MD..O..#....H.T...:T..>..r>....Q..xI....|6mG.77..DrQ..OtQ..2..[...Pf'.......{a..:dq_;;..Q..O.o.q.0.|u.U..N1....O..+..G....C...L..;a...Y...^(+..o.U.=...`.......;.?.......O....8..3..|;.o.:..A
09:53:05.027720 IP (tos 0x0, ttl 44, id 52689, offset 0, flags [DF], proto TCP (6), length 588)
82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0x5d6e (correct), seq 2144:2680, ack 2615, win 501, options [nop,nop,TS val 4039839499 ecr 1207373674], length 536
E..L..@.,..?R.gH..+.......s
...x....]n.....
....G..j..........0.........B..g.j.Ha=f..................'.&....;lk..Z...^q......X.\.....v........zu{..+gI.X.K5;T..Vfs|...l..d..............Y.f7.v......gr.q....`.`...O....K.XG].t.Q..B...cXxw.....Xo:H..r$....L u.$<...iL.B)CY.:....L...i(9.b.. /.%....O...805....nW'....n...t8D..x.b..........w...'.yh..J#5..7.=.l..Yx~.)....`I3.2O<....#.x.....).nf.[.b. #.m....h..3...
.(vV..~?SI8..x.9b.*.!..Yp.y...4#...>......N.A.....r_... 9N.th.x....;F*.............w/...v.....|.p......uX....!...i..Y..S.3x.r."VU{......1)L.h...8...L$.F.o].Y5a*...FPF.q .Lr.....
...
09:53:05.029099 IP (tos 0x0, ttl 64, id 38652, offset 0, flags [DF], proto TCP (6), length 588)
localhost.localdomain.59018 > 82.165.103.72.https: Flags [P.], cksum 0xff8b (correct), seq 2615:3151, ack 2680, win 762, options [nop,nop,TS val 1207373844 ecr 4039839499], length 536
E..L..@.@.....+.R.gH.......x..u"...........
G............6......@.!.L[2s.....P.G.c..P...uk....G.f=x.<..K.....u...\....<AU......o...oV...../....J..gw.2TNG.......H_....V.x.e."...w.._.Yg.a..K1..H'.0.u`..1.i...7...\Nh.|...g.i=X%..e.:.e$...=.:mH
答案1
以 root 用户身份运行 netstat
输出netstat显示一个 TCP 会话正在生成以下流量tcpdump：
tcp 0 0 192.168.43.5:59018 82.165.103.72:443 ESTABLISHED -
您应该以用户身份运行 netstat 命令root来显示建立此 TCP 会话的进程的PID信息。process name
跟踪进程的网络活动
一旦获得了 PID，您可能希望使用以下方法更彻底地调查该进程生成的网络流量：
strace -f -e trace=network -p <PID>
禁用 tcpdump 地址转换
此外，为了更好地将tcpdump输出与netstat输出进行比较，您可能需要执行禁用将地址转换为名称的选项tcpdump：-n
-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.