I have sssd for connecting to LDAP server. In sssd.conf ldap_uri=target_server.com
But using tcpdump i see non-targeted and targeted traffic to ldap port. When the sssd is stopped non-target and targeted traffic stopped too. This means that the traffic source is associated with sssd. How can i track what is the source of traffic if sssd.conf configured correctly?
I tried to track the source by port. Used netstat -tulpn for this, but port is switching so fast that I couldn't keep up.