DE

↑ ↓ select, Enter open, Esc close

Show outgoing SMTP connections and their processes

harmless rootNetworkalle
Adjust the values, the command updates live
root@server
ss -Htnp state established '( dport = :25 )'

Lists all established TCP connections whose destination port is the given port, with the remote address and the responsible process including its PID. Normally only the mail server (Postfix or qmail) opens such connections. If php-fpm, php or an unknown process shows up here, a compromised script is probably sending spam directly.

Note: ls -l /proc/PID/cwd reveals the working directory of the process and often the affected website.

Also searched as

  • find which process is sending spam
  • show outgoing connections port 25
  • php script sending spam find

Related one-liners

All in Network

Count TCP connections by state

$ss -Htan | awk '{print $1}' | sort | uniq -c | sort -rn
harmlessNetwork

Count web server connections per IP address

$ss -Htn state established '( sport = :80 or sport = :443 )' | awk '{print $4}' | rev | cut -d: -f2- | rev | sort | uniq -c | sort -rn | head -20
harmlessNetwork

List open ports and listening services

#ss -tulpn
harmlessNetwork

Check if a server IP is on the Spamhaus blacklist

$dig +short $(echo 203.0.113.10 | awk -F. '{print $4"."$3"."$2"."$1}').zen.spamhaus.org
harmlessDNS

Check if Plesk is listening on ports 8443 and 8880

#ss -tlnp | grep -E ':(8443|8880)\b'
harmlessPlesk

Compare max connections with the peak so far

#mysql -e "SHOW GLOBAL STATUS LIKE 'Max_used_connections'; SHOW GLOBAL VARIABLES LIKE 'max_connections';"
harmlessMySQL and MariaDB

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.