How to easily get all HTTPS addresses that an application connects to externally?
Here are a couple of command line options.
Use watch
with lsof
From this answer to Monitor outgoing web requests as they’re happening, you could use lsof
and watch
.
To quote the answer in its entirety:
You can use
lsof
andwatch
to do this, like so:$ watch -n1 lsof -i TCP:80,443
Example output
dropbox 3280 saml 23u IPv4 56015285 0t0 TCP greeneggs.qmetricstech.local:56003->snt-re3-6c.sjc.dropbox.com:http (ESTABLISHED) thunderbi 3306 saml 60u IPv4 56093767 0t0 TCP greeneggs.qmetricstech.local:34788->ord08s09-in-f20.1e100.net:https (ESTABLISHED) mono 3322 saml 15u IPv4 56012349 0t0 TCP greeneggs.qmetricstech.local:54018->204-62-14-135.static.6sync.net:https (ESTABLISHED) chrome 11068 saml 175u IPv4 56021419 0t0 TCP greeneggs.qmetricstech.local:42182->stackoverflow.com:http (ESTABLISHED)
I have just tried it and it is pretty useful. You could reduce the repeat time to 0.1 seconds if you use -n0
.
Just lsof
From Monitoring files continuously with lsof, you could dispense with watch
and use just lsof
in conjunction with the repeat (-r
) option. The following repeats every two seconds
$ lsof -i TCP:80,443 -r 2
but the output isn't as pretty, although the past connections are better preserved:
=======
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
firefox 9542 user 27u IPv4 1068219 0t0 TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED)
firefox 9542 user 48u IPv4 1053405 0t0 TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED)
=======
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
firefox 9542 user 27u IPv4 1068219 0t0 TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED)
firefox 9542 user 48u IPv4 1053405 0t0 TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED)
firefox 9542 user 52u IPv4 1138942 0t0 TCP user-300V3Z-300V4Z-300V5Z:57602->kul08s01-in-f10.1e100.net:https (SYN_SENT)
firefox 9542 user 102u IPv4 1139934 0t0 TCP user-300V3Z-300V4Z-300V5Z:49102->kul09s13-in-f14.1e100.net:https (ESTABLISHED)
firefox 9542 user 110u IPv4 1138950 0t0 TCP user-300V3Z-300V4Z-300V5Z:49104->kul09s13-in-f14.1e100.net:https (SYN_SENT)
=======
...
=======
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
firefox 9542 user 27u IPv4 1068219 0t0 TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED)
firefox 9542 user 48u IPv4 1053405 0t0 TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED)
firefox 9542 user 51u IPv4 1140129 0t0 TCP user-300V3Z-300V4Z-300V5Z:52284->kul09s13-in-f10.1e100.net:https (ESTABLISHED)
firefox 9542 user 108u IPv4 1137384 0t0 TCP user-300V3Z-300V4Z-300V5Z:55886->103.229.10.236:https (ESTABLISHED)
firefox 9542 user 122u IPv4 1137399 0t0 TCP user-300V3Z-300V4Z-300V5Z:55870->kul08s12-in-f1.1e100.net:https (ESTABLISHED)
firefox 9542 user 126u IPv4 1137402 0t0 TCP user-300V3Z-300V4Z-300V5Z:47370->stackoverflow.com:https (SYN_SENT)
Note: Every two seconds interval is separated by =======
.
See also how to find URLs accessed by a process, although, given the promising title, the two answers unfortunately don't seem to provide a filter on a per application, or per process, basis.
Other useful tricks with lsof
are described here, 15 Linux lsof Command Examples (Identify Open Files), which would allow you to filter the results of lsof
more, so that you can customise the commands above to more your taste.