Examkin

Question

Difficulty: MediummacOS and Linux Operating System Features and Tools

A Linux technician suspects that a server has an unauthorized background process establishing outbound network sessions. The technician needs to view all active TCP connections along with the associated Process ID (PID) for each socket directly from the terminal. Which command should the technician execute?

  1. netstat -tupAnswer
  2. B
    ps aux
  3. C
    ifconfig -a
  4. D
    traceroute

Answer

The command 'netstat -tup' (or netstat -antp) displays active TCP network connections along with the associated Process ID (PID) and program name for each connection.
The command 'netstat -tup' correctly identifies open network sockets (TCP/UDP) and displays the associated Process ID (PID) and program name for each connection, allowing the technician to pin down unauthorized network activity to a specific running process.

Step-by-Step Solution

1
Identify the diagnostic requirement
The technician needs a tool that correlates active network connections with process identifiers (PIDs).
Inspecting network sockets alone does not identify which process generated the traffic.
2
Evaluate command-line networking utilities
The netstat utility (or modern equivalent ss) with process options lists socket state, source/destination addresses, and the PID/program name bound to each socket.
The -p flag specifically instructs netstat to retrieve and print the PID and program name for each socket.

Key Concept

Linux/macOS Network Process and Socket Monitoring
Rate this question

Topics

macOS and Linux Operating System Features and Tools

More questions from this topic