find the PID doing DNS queries?

[dsr-mzpnVDyJpH4k7aNtvndDlA at public.gmane.org (Dan Ritter)]

On Tue, Mar 03, 2009 at 10:37:30AM -0800, Dan Kressin wrote:
> 
> --- On Tue, 3/3/09, Ben Eisenbraun <bene-Gk2boCrsRs1AfugRpC6u6w at public.gmane.org> wrote:
> > > Is there any way to determine the PID of the process(es) that are doing
> > > the DNS queries?
> > 
> > SystemTap?
> > 
> > http://sourceware.org/systemtap/examples/keyword-index.html#NETWORK
> > 
> > -ben
> 
> Looks neat, but seems to require a 2.6 kernel.  Mine are 2.4 (RHEL3)  :(

How about starting with

lsof -i udp

You may have other filtering options, but that should start it.


-dsr-

-- 
http://tao.merseine.nu/~dsr/eula.html is hereby incorporated by reference.

You can't defend freedom by getting rid of it.