Linux – How to identify PID of process that is generating lots of ICMP ping requests

icmplinuxnetworkingpingrhel7

I have a box that is generating lots of outgoing ICMP requests. I am able to see a few happening every second with tcpdump -nni ens192 icmp. However, I don't have anyway of tracing these back to the PID that is causing them. Any thoughts?

Best Answer

Try the command

ss -npa | grep -e '???' -e icmp

I get this result while running ping:

???     UNCONN  0    0    0.0.0.0:1 0.0.0.0:* users:(("ping",pid=7174,fd=3)) 
icmp6   UNCONN  0    0    *:58      *:*       users:(("ping",pid=7174,fd=4))

While there are different ways to send ICMP packets, it is worth a try.

Related Topic