I have a Linux server that is very occasionally reaching out to a specific IP address. It’s actually being blocked by pfBlockerNG, which is fine. But I’d like to know which process on the server is doing this. Netstat isn’t much help because, by the time I run it, the connection attempt is long gone.
I’d like to run a process on the server that can watch for attempts to access that IP and log which process is doing it. As far as I know, tcpdump won’t give me that info. Any thoughts on what tool I could use?
