> ## Documentation Index
> Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate a remote address or network

> Start from an IP address or CIDR network and find the processes that talk to it, the files sent to it, and the sockets and flows that carried them.

An alert names an address, a firewall log shows an unexpected destination, or a cloud bill shows egress to a network you do not recognise. Filetrace turns that address into processes and files: who talks to it, what was sent, and over which connections. Wherever this page takes an address, a single address or a CIDR network works, IPv4 or IPv6.

> [!NOTE]
>
> The agent must be running, and it only knows what happened since it started. Run the commands with `sudo` when the agent runs as root.

## Summarize an address

`filetrace inspect ip` gives the overview: bytes in each direction, the number of flows and processes, and the file transfers to that address.

```bash theme={null}
sudo filetrace inspect ip 203.0.113.25
sudo filetrace inspect ip 203.0.113.0/24 --since 1h
```

```text theme={null}
ADDRESS
────────────────────────────────────
Remote:           203.0.113.25
Sent to it:       74.9 MB (3.98 MB/s)
Received from it: 73.4 MB
Flows:            9
Processes:        9
File transfers:   3
```

The report continues with two lists: **PROCESSES**, each with its current outbound rate and the bytes it sent to and received from the address, and **FILES SENT TO IT**, with the file, process, remote endpoint, bytes, method and confidence of every transfer. `--limit` sets the number of rows per list (20 by default).

## List the files sent to it

```bash theme={null}
sudo filetrace files --remote 203.0.113.0/24
sudo filetrace files --remote 203.0.113.0/24 --confidence exact --min-bytes 1MB
```

`files` lists only bytes that a file accounts for. To include sent bytes with no associated file, use `transfers`, which shows `unknown` in the `FILE` column for them:

```bash theme={null}
sudo filetrace transfers --remote 203.0.113.0/24
```

```text theme={null}
ID        PROCESS  FILE                 REMOTE                BYTES  METHOD    CONFIDENCE
tr_3      nginx    /var/www/stream.bin  203.0.113.25:51871  15.5 MB  sendfile  EXACT
tr_se     python   unknown              203.0.113.25:45789  48.8 KB  -         UNKNOWN
```

## Find the connections and flows

`connections` lists sockets by their two ends; `flows` lists the bytes each process exchanged with each remote endpoint. Both take `--remote`, `--port` and `--protocol`.

```bash theme={null}
sudo filetrace connections --remote 203.0.113.25
sudo filetrace flows --remote 203.0.113.0/24 --group-by process
```

`--group-by` merges flows by `process`, `remote`, `port` or `protocol`, which turns a long list into a ranking. To see the top destinations of the whole machine instead:

```bash theme={null}
sudo filetrace top destinations --since 1h
```

## Drill into one socket or flow

The `SOCKET` column of `connections` and the `FLOW` column of `flows` are IDs that `inspect` takes:

```bash theme={null}
sudo filetrace inspect socket 16
sudo filetrace inspect flow 7
```

`inspect socket` shows the socket's ends, owner, traffic and the files sent on it; `inspect flow` shows one process's traffic with one remote endpoint on that socket.

## Names instead of addresses

`--resolve-hostnames` shows remote addresses by host name where a reverse DNS lookup finds one:

```bash theme={null}
sudo filetrace files --remote 203.0.113.0/24 --resolve-hostnames
```

> [!WARNING]
>
> The lookups go to the system's DNS resolver, which then learns which addresses you are looking at. Leave the option off during an investigation that must stay quiet.

## Watch the address live

```bash theme={null}
sudo filetrace watch --remote 203.0.113.0/24
sudo filetrace events --follow --remote 203.0.113.0/24 --type file_transfer,network_send
```

See [Watch transfers live](https://filetrace.mintlify.site/guides/live-monitoring.md) for the live view and [`events`](https://filetrace.mintlify.site/cli/events) for the event stream.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.