`netstat -tp` -- that'll show you TCP connections and the associated program, doing a DNS lookup for the IPs they're connected to.

[e0qdk@reddthat.com]

netstat -tp -- that'll show you TCP connections and the associated program, doing a DNS lookup for the IPs they're connected to. You may need elevated permissions to see what some processes are.

There are a bunch of other options (e.g. -n to get numeric output instead of looking up names, -l to get programs listening for incoming connections, etc); check the man pages for more details.

[ihawkmike@lemmy.world]

Most DNS queries are UDP.

I'd do a modified scream test and change old.domain to something like 1.2.3.4. Then run sudo netstat or ss with -tpn, grepping for 1.2.3.4.

Or something like grep -r old.domain /etc.