detecting which process sends out UDP traffic

hi,
i noticed that my system sends out a DNS request every couple of
seconds. how can i find out which process is doing this?
i ran "lsof -(E-Mail Removed)" which is supposed to show the process
which has an open socket to the dns server's ip, but it didn't show
anything.
also netstat didn't show any sockets..
any way to do this?
thanks in advance,
-Aaron

On Sat, 04 Sep 2004 20:22:07 -0700, uzon wrote:

> hi,
> i noticed that my system sends out a DNS request every couple of seconds.
> how can i find out which process is doing this? i ran "lsof
> -(E-Mail Removed)" which is supposed to show the process which has an open
> socket to the dns server's ip, but it didn't show anything.
> also netstat didn't show any sockets.. any way to do this?
> thanks in advance,

The only way I know how to do this is to arrange somehow for the query not
to be answered. If it's querying your own nameservers you can shut them
down, or you can put in temporary firewall rules to prevent the query
going out or the response coming back. Then the socket will stay open long
enough to catch it with lsof.

Regards, Ian

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message

In comp.os.linux.networking uzon <(E-Mail Removed)> suggested:
> hi,
> i noticed that my system sends out a DNS request every couple of
> seconds. how can i find out which process is doing this?
> i ran "lsof -(E-Mail Removed)" which is supposed to show the process
> which has an open socket to the dns server's ip, but it didn't show
> anything.

lsof -i UDP:53

Should show anything using port 53/UDP, perhaps you can work it
out from there run it in a loop for a few minutes, just keep an
eye on your logfile size. 'tcpdump' should be helpful in addition.

--
Michael Heiming (GPG-Key ID: 0xEDD27B94)
mail: echo (E-Mail Removed) | perl -pe 'y/a-z/n-za-m/'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBOww+AkPEju3Se5QRAvb8AJoCNbfrHiJ9EQ28AjLj/P5UNEI1ogCgvx/1
b0PNVPu8JV3FuxetMPeEYUI=
=RUTm
-----END PGP SIGNATURE-----

worked like a charm.
thanks