I'm looking for a network monitor running on Linux, showing me in real-time
- open connections
- the process owning them
- the target IP (and optionally port)
- allow me to "freeze" the output (i.e. pause updating, so I can investigate details before they disappear)
Preferably for the command-line (strong preference), alternatively with GUI. I don't want a background service I have to visit with a different frontend, also not in the browser.
I'm aware of
- iftop: doesn't show me the application behind a connection
- ifstat: doesn't update real time
- iptraf: again lacks the application part (unless I've missed that), and also forces me to chose between showing the IP and the resolved host name (I'd prefer seeing both together)
iptraf-ng comes closest to what I'm after, but lacks the details I've pointed out and need.
The software should be open-source and free, as well as preferably being available as a
.deb in the repositories (Linux Mint 18.1 here; PPAs definitely acceptable).
No need for package capturing etc. Main purpose is to find out which application connects where to and when :)
For a work-around, I just figured I can use
iftop, watching its output, hit P to freeze it, pick the "suspicious IP address", and then (in another terminal window) run
lsof -i in a loop – canceling it via Ctrl-C as soon as it spit out the details needed:
while true; do line="$(lsof -i|grep 126.96.36.199)" [[ -n "$line" ]] && echo "$line" sleep 1; done
But of course this would only work for repeating appearances (or connections staying open long enough).