We are stuck in identifying which process or service that we are running in our linux machine is making a connection to a remote IP. We are getting complaints of our network accessing the remote IP port 80 HTTP Tomcat Admin page access.

Using the below tcpdump, we were able to find that there is an outgoing request being made to the IP address from which we received the complaint, but not able to identify which process is making it.

tcpdump -vvv -i ens192 src 192.168.23.4 and dst port 80

How can we find which process trying to make connection to specific IP in linux centos7 environment.