19

I want to see a list of all outgoing HTTP requests from my desktop. I think it should be possible to monitor HTTPS hostnames as well for local clients using Server Name Indication (SNI).

OS X has a nice GUI utility called Little Snitch, which is a per-app HTTP monitor and firewall rule front-end.

I would settle for a nice terminal utility. tcpdump is overkill as I just want to see where the traffic is going in real-time and not the transmitted data. Ideally, I would like to see what process made the request as well, but just seeing what dials home would be a nice start.

Improve this question

2 Answers 2

Reset to default
23

You can use lsof and watch to do this, like so:

$ watch -n1 lsof -i TCP:80,443

Example output

dropbox 3280 saml 23u IPv4 56015285 0t0 TCP greeneggs.qmetricstech.local:56003->snt-re3-6c.sjc.dropbox.com:http (ESTABLISHED) thunderbi 3306 saml 60u IPv4 56093767 0t0 TCP greeneggs.qmetricstech.local:34788->ord08s09-in-f20.1e100.net:https (ESTABLISHED) mono 3322 saml 15u IPv4 56012349 0t0 TCP greeneggs.qmetricstech.local:54018->204-62-14-135.static.6sync.net:https (ESTABLISHED) chrome 11068 saml 175u IPv4 56021419 0t0 TCP greeneggs.qmetricstech.local:42182->stackoverflow.com:http (ESTABLISHED)
Improve this answer
3

An alternative to Creek's answer (whilst also using part of it) is to dispense with watch, and use the -r option to lsof instead, to end up with a repetitive log scrolling up the terminal, for example

lsof -i TCP:80,443 -r 1

which repeats every one second, and each repeat's output is separated by =======. It may not be as pretty, but it gives a scrollable history, for example:

======= COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME firefox 9542 user 27u IPv4 1068219 0t0 TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED) firefox 9542 user 48u IPv4 1053405 0t0 TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED) ======= COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME firefox 9542 user 27u IPv4 1068219 0t0 TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED) firefox 9542 user 48u IPv4 1053405 0t0 TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED) firefox 9542 user 52u IPv4 1138942 0t0 TCP user-300V3Z-300V4Z-300V5Z:57602->kul08s01-in-f10.1e100.net:https (SYN_SENT) firefox 9542 user 102u IPv4 1139934 0t0 TCP user-300V3Z-300V4Z-300V5Z:49102->kul09s13-in-f14.1e100.net:https (ESTABLISHED) firefox 9542 user 110u IPv4 1138950 0t0 TCP user-300V3Z-300V4Z-300V5Z:49104->kul09s13-in-f14.1e100.net:https (SYN_SENT) ======= ... ======= COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME firefox 9542 user 27u IPv4 1068219 0t0 TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED) firefox 9542 user 48u IPv4 1053405 0t0 TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED) firefox 9542 user 51u IPv4 1140129 0t0 TCP user-300V3Z-300V4Z-300V5Z:52284->kul09s13-in-f10.1e100.net:https (ESTABLISHED) firefox 9542 user 108u IPv4 1137384 0t0 TCP user-300V3Z-300V4Z-300V5Z:55886->103.229.10.236:https (ESTABLISHED) firefox 9542 user 122u IPv4 1137399 0t0 TCP user-300V3Z-300V4Z-300V5Z:55870->kul08s12-in-f1.1e100.net:https (ESTABLISHED) firefox 9542 user 126u IPv4 1137402 0t0 TCP user-300V3Z-300V4Z-300V5Z:47370->stackoverflow.com:https (SYN_SENT)

Note: I only had Firefox open, so only one application is showing.

Obviously this output could be redirected or piped to a (log) file.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.