Can someone share steps/point me to a guide to identify a process on my debian system that is calling a specific domain? I have a raspberry running since a few years and did an upgrade of a domain name. So instead of calling “old.home.lab” it’s now at “new.home.lab” how could I look out for “old.home.lab” calls? I tried a few utilities but couldn’t get to the point where I would be able to monitor the domain, only IPs.

I have found out about my home lab calling it by looking at the nextDNS logs.

Thanks in advance!

  • e0qdk@reddthat.comEnglish
    9·
    1 year ago

    netstat -tp – that’ll show you TCP connections and the associated program, doing a DNS lookup for the IPs they’re connected to. You may need elevated permissions to see what some processes are.

    There are a bunch of other options (e.g. -n to get numeric output instead of looking up names, -l to get programs listening for incoming connections, etc); check the man pages for more details.

    • IHawkMike@lemmy.worldEnglish
      3·
      1 year ago

      Most DNS queries are UDP.

      I’d do a modified scream test and change old.domain to something like 1.2.3.4. Then run sudo netstat or ss with -tpn, grepping for 1.2.3.4.

      Or something like grep -r old.domain /etc.