I could have sword I used to know this but I can't figure it out. How do I determine which program/script on my server is using a specific TCP session?
Background (for the curious):
I have a tiny VM that I run as a hobby. It's basically a place to put files that I can get to on the Internet. Nothing fancy. A couple of days ago I noticed that there was a steady flow of network traffic (since I am the only user of my services, network traffic is usually zero unless I'm doing something). So, today I decided to figure out what was going on.
Netstat revealed that there was an established connection with an Amazon EC2 instance. My VM is not with Amazon and I don't have an EC2 instance. So, this was decidedly odd. Tcpdump showed that the EC2 instance was sending data to my server (slowly).
What do I use to find out which program/application (preferably PID) is on my end of that established connection?
Background (for the curious):
I have a tiny VM that I run as a hobby. It's basically a place to put files that I can get to on the Internet. Nothing fancy. A couple of days ago I noticed that there was a steady flow of network traffic (since I am the only user of my services, network traffic is usually zero unless I'm doing something). So, today I decided to figure out what was going on.
Netstat revealed that there was an established connection with an Amazon EC2 instance. My VM is not with Amazon and I don't have an EC2 instance. So, this was decidedly odd. Tcpdump showed that the EC2 instance was sending data to my server (slowly).
What do I use to find out which program/application (preferably PID) is on my end of that established connection?