Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way I can monitor connections that are attempted/made to my linux server? I'm running Debian Lenny.

share|improve this question
2  
need more info on what you're trying to accomplish –  freiheit Jul 24 '10 at 23:28
add comment

5 Answers

up vote 1 down vote accepted

You could also set up iptables to log when a TCP connection is started or attempted. UDP is trickier, since there's no real "start" or "stop" for UDP, just packets.

share|improve this answer
add comment

Aren't they logged into /var/log/messages?

share|improve this answer
add comment

It all depends on what you specifically want to do; What type of monitoring? Full content of the connections or just basic session information? In realtime or do you want to log to a file for later analysis?

Something like TCPDump would be a great real-time monitor, and you can also save to a pcap file for later analysis.

-Josh

share|improve this answer
add comment

I find the iptstate tool really useful to monitor iptables entries in real time. On Fedora it is a yum install iptstate so I imagine in Debian you can install via apt-get.

As already mentioned, for very detailed analysis, tcpdump is awesome (or alternatively Wireshark).

Not sure about Debian, but on Fedora you need to adjust the settings in /etc/rsyslog.conf to configure verbose firewall logs in syslog or a custom log file.

For regular reports, Logwatch is also worth checking out.

share|improve this answer
add comment

You could try scheduling command ss -s to check number of connections made on your server at some convenient interval using cron tab.

Or there is a free service, SeaLion which you can use to schedule commands and see output online.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.