Listing applications that use a specific port to connect to external services

Products

• VMware Tanzu Application Service

Issue/Introduction

There might be cases when an operator needs to know which app are accessing a particular server. E.g:

There is a mysql server with IP 10.225.50.32 listening to connections on port 3306 and the operator wants to know which apps are connecting to it. 

Resolution

The mysql server access logs will show a connection coming from the Diego Cell IP (10.225.50.39 in our example).

Locate the diego cell by running 

bosh vms | grep 10.225.50.39

and bosh ssh into it.

Run the following script in the diego cell, changing <port> with the one searching for. In this case, port is 3306

for pid in $(sudo lsns --type=net -o PID | grep -v PID); do
  sudo nsenter -n -t "${pid}" netstat -tnap | grep <port>
done

It will show an output as following. 

tcp        0      0 10.255.172.23:46946     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:37248     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:56104     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:37238     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:60550     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:56142     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:44854     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:47894     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:44870     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.23:56674     10.225.50.32:3306       ESTABLISHED 2283585/java
tcp        0      0 10.255.172.86:42806     10.225.50.4:3306        ESTABLISHED 2735393/bin/cf-auto
tcp        0      0 10.255.172.86:42812     10.225.50.4:3306        ESTABLISHED 2735393/bin/cf-auto
tcp        0      0 10.255.172.86:42850     10.225.50.4:3306        ESTABLISHED 2735393/bin/cf-auto
tcp        0      0 10.255.172.78:41232     10.225.50.4:3306        ESTABLISHED 2699535/sh

In this case, the server IP is known, which is 10.225.50.32, so the pid connecting to that IP trough port 3306 is 2283585.

Then you need to run following command with the pid. 

sudo cat /proc/<PID>/environ | xargs -0 -L1 | grep VCAP_APPLICATION | cut -d "=" -f2- | jq

All the app info needed to locate it will be diplayed: name, org and space. In this case would look as below.

diego_cell/b0a79586-7a53-4667-9b85-324cddd357eb:~$ sudo cat /proc/2283585/environ | xargs -0 -L1 | grep VCAP_APPLICATION | cut -d "=" -f2- | jq
{
  "application_id": "caf8aa1e-4bbb-4178-a7e9-cb1b6bbad1fe",
  "application_name": "spring-music",
  "application_uris": [
    "spring-music-resplendent-gorilla-as.cfapps-25.slot-34.tanzu-gss-labs.vmware.com"
  ],
  "application_version": "e423f694-4c35-48d5-b119-388524662325",
  "cf_api": "https://api.run-25.slot-34.tanzu-gss-labs.vmware.com",
  "host": "0.0.0.0",
  "instance_id": "dcd1b3df-2c0e-4630-4797-6060",
  "instance_index": 0,
  "limits": {
    "disk": 1024,
    "fds": 16384,
    "mem": 1024
  },
  "name": "spring-music",
  "organization_id": "26e064b4-4663-4476-b00a-d69ededb1529",
  "organization_name": "test",
  "port": 8080,
  "process_id": "caf8aa1e-4bbb-4178-a7e9-cb1b6bbad1fe",
  "process_type": "web",
  "space_id": "a3046a9b-c75a-4b62-a80a-27b83a0e23b0",
  "space_name": "test",
  "uris": [
    "spring-music-resplendent-gorilla-as.cfapps-25.slot-34.tanzu-gss-labs.vmware.com"
  ],
  "version": "e423f694-4c35-48d5-b119-388524662325"
}

from the above we get, "application_name", "organization_name" and  "space_name" which is all info needed to locate the app.