How to determine which process sends UDP packets periodically to an IP address?

Question

I tried looping with netstat and but the packets are small and not frequent so do not get caught (can still see them with tcpdump). Need to know which process sends those packets.

Solution

Check tcpdump for the source port number of the packets. Then run

sudo netstat -a -u -n --program

Look for the PID/Program name matching the source port number.

This assumes that the sending process is leaving its socket open between sends, which is what any normal program would do. If you are dealing a program that is deliberately trying to hide itself, that's whole different story.

Comments

[Cougar]

Have you tired iptables --log-uid option?