From my firewall logs, I've got a process n a Centos host attempting to initiate a connection to the auth daemon (which isn't running) on another server. In order to clean things up, I'd like to identify which process is periodically making this attempt, and stop it.

I've been playing around with "watch" and "ss" but so far, to no avail. I can see the calls with tcpdump, but can't track the process ID back to a process.

Has anyone got any ideas for a way to identify the process, given that it's an intermittent attempt?

There would be much cleaner ways of doing this, but here is some direction for an easy way. On the system initiating the connection:

- Use iptables to match the traffic you're interested in and LOG it, which will write a message to /var/log/syslog
- Use a file watcher of your choice to read every syslog message and "grep" for the log messages generated by iptables for your match. If you want to take action multiple times, rather than just once, incron may be helpful to you here rather than something like tailf.
- Anytime you find a match, run netstat -nap. This will show you the TCP port in whatever state, as well as the process ID and name responsible for it. Run grep for the port you're interested in to cut down on spam.

That should be enough to get you going.

In the end, I just used:
# watch -d "netstat -anp | grep 113"

and waited until something popped up. Turned out exim is hitting the non-existent authd. Now to find out why.