I have several Linux (mostly Debian) servers running on a Proxmox platform. All of them connecting to Internet through an ADSL line, with only one public IP.One of them is running OMD (open monitoring distribution) since longer than a year ago to monitor an EXTERNAL server (other network, monitored through that ADSL connecting to Internet.Now I have received a message from the owners of the remote server saying that they have detected a port scan run in the night from my ADSL public IP scanning their open ports.It's the second time this happens to me with a Debian system :(I need to detect the process running that scanhow can I find out what process is launching that portscan from the offending linux box? The difficulty here is that I'd need to run -whatever- to know the process when the scan takes place -which can happen at some moment in the night-.Is there a way to get a list of processes that have somehow being launched and then finished between two times (i.e. new processes started from 23:00 to 03:00)Thanks in advance
How to find out what is launching a port scan in the night from my Linux?
linux;debian
The best way to keep track of such unwanted behavior is to collect logs of your machine activity from time to time.Running a script every 15 minutes with cron that will look at open network connexions might be the best way to go.I would advise you to use the lsof command and collect information about the network connexion made by your machine. Something like:lsof -i@scanned-server.domain.net >> /tmp/my-connexions.logOr, if your machine is scanning randomly and change the IPs scanned every time you may us (restrict to TCP connexions only):lsof  -iTCP >> /tmp/my-connexions.logThe result of an lsof command is as follow:iceweasel 31562 user 50u IPv4 13500060   0t0  TCP bill:47039->stackoverflow.com:https (ESTABLISHED)iceweasel 31562 user 60u IPv4 13549538   0t0  TCP bill:60564->104.16.15.128:http (ESTABLISHED)iceweasel 31562 user 61u IPv4 13578815   0t0  TCP bill:46285->185.45.5.43:https (ESTABLISHED)iceweasel 31562 user 67u IPv4 13496262   0t0  TCP bill:47020->stackoverflow.com:https (ESTABLISHED)On the leftmost of each line, you can see the name of the program running the connexion (which is the interesting part in your case). The rest of the line describe the connexion and the protocol used.You may also look at auditctl (comes with the auditd package) that will log any system call of a program to the kernel (which is much more precise that running an lsof from time to time). You can run something like (read the documentation first, as always!):auditctl -A exit,always -S connect