Investigate a remote address or network

An alert names an address, a firewall log shows an unexpected destination, or a cloud bill shows egress to a network you do not recognise. Filetrace turns that address into processes and files: who talks to it, what was sent, and over which connections. Wherever this page takes an address, a single address or a CIDR network works, IPv4 or IPv6.

The agent must be running, and it only knows what happened since it started. Run the commands with sudo when the agent runs as root.

Summarize an address

filetrace inspect ip gives the overview: bytes in each direction, the number of flows and processes, and the file transfers to that address.

sudo filetrace inspect ip 203.0.113.25
sudo filetrace inspect ip 203.0.113.0/24 --since 1h

ADDRESS
────────────────────────────────────
Remote:           203.0.113.25
Sent to it:       74.9 MB (3.98 MB/s)
Received from it: 73.4 MB
Flows:            9
Processes:        9
File transfers:   3

The report continues with two lists: PROCESSES, each with its current outbound rate and the bytes it sent to and received from the address, and FILES SENT TO IT, with the file, process, remote endpoint, bytes, method and confidence of every transfer. --limit sets the number of rows per list (20 by default).

List the files sent to it

sudo filetrace files --remote 203.0.113.0/24
sudo filetrace files --remote 203.0.113.0/24 --confidence exact --min-bytes 1MB

files lists only bytes that a file accounts for. To include sent bytes with no associated file, use transfers, which shows unknown in the FILE column for them:

sudo filetrace transfers --remote 203.0.113.0/24

ID        PROCESS  FILE                 REMOTE                BYTES  METHOD    CONFIDENCE
tr_3      nginx    /var/www/stream.bin  203.0.113.25:51871  15.5 MB  sendfile  EXACT
tr_se     python   unknown              203.0.113.25:45789  48.8 KB  -         UNKNOWN

Find the connections and flows

connections lists sockets by their two ends; flows lists the bytes each process exchanged with each remote endpoint. Both take --remote, --port and --protocol.

sudo filetrace connections --remote 203.0.113.25
sudo filetrace flows --remote 203.0.113.0/24 --group-by process

--group-by merges flows by process, remote, port or protocol, which turns a long list into a ranking. To see the top destinations of the whole machine instead:

sudo filetrace top destinations --since 1h

Drill into one socket or flow

The SOCKET column of connections and the FLOW column of flows are IDs that inspect takes:

sudo filetrace inspect socket 16
sudo filetrace inspect flow 7

inspect socket shows the socket’s ends, owner, traffic and the files sent on it; inspect flow shows one process’s traffic with one remote endpoint on that socket.

Names instead of addresses

--resolve-hostnames shows remote addresses by host name where a reverse DNS lookup finds one:

sudo filetrace files --remote 203.0.113.0/24 --resolve-hostnames

The lookups go to the system’s DNS resolver, which then learns which addresses you are looking at. Leave the option off during an investigation that must stay quiet.

Watch the address live

sudo filetrace watch --remote 203.0.113.0/24
sudo filetrace events --follow --remote 203.0.113.0/24 --type file_transfer,network_send

See Watch transfers live for the live view and events for the event stream.

Get started

Concepts

Guides

Investigate a remote address or network

Summarize an address

List the files sent to it

Find the connections and flows

Drill into one socket or flow

Names instead of addresses

Watch the address live

​Summarize an address

​List the files sent to it

​Find the connections and flows

​Drill into one socket or flow

​Names instead of addresses

​Watch the address live

Summarize an address

List the files sent to it

Find the connections and flows

Drill into one socket or flow

Names instead of addresses

Watch the address live