Question: A rogue script is calling an external API. How do I find and stop it?
Try:sudo ss -tnp dst 203.0.113.45
Info: Filters socket connections by destination IP to expose associated processes and PIDs for immediate termination.
Examples:
$ sudo ss -tnp 'dst 192.168.1.0/24' # Filter connections targeting an entire subnet
$ sudo lsof -i @203.0.113.45 # Inspect active network sockets using lsof
$ sudo iptables -I OUTPUT -d 203.0.113.45 -j DROP # Block outbound traffic at the firewall level
Note: If terminated processes respawn instantly, inspect parent processes using pgrep -P. Firewall rules provide more durable blocking than process termination.
LinuxTeck.com
linuxteck:~$ sudo ss -tnp dst 203.0.113.45
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
ESTAB 0 0 192.168.1.50:54321 203.0.113.45:443 users:(("curl",pid=5678,fd=4))
ESTAB 0 0 192.168.1.50:54322 203.0.113.45:443 users:(("python3",pid=6789,fd=6))
linuxteck:~$ sudo kill 5678 6789
linuxteck:~$ sudo ss -tnp dst 203.0.113.45
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
linuxteck:~$
John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.
Leave a Reply