I used

auditd

and then

aureport

, looks like the top exe for

connect

syscalls is

check_ping

which also makes sense