Is there a way I can monitor connections that are attempted/made to my linux server? I'm running Debian Lenny.
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
You could also set up iptables to log when a TCP connection is started or attempted. UDP is trickier, since there's no real "start" or "stop" for UDP, just packets. |
|||
|
|
|
Aren't they logged into /var/log/messages? |
|||
|
|
|
It all depends on what you specifically want to do; What type of monitoring? Full content of the connections or just basic session information? In realtime or do you want to log to a file for later analysis? Something like TCPDump would be a great real-time monitor, and you can also save to a pcap file for later analysis. -Josh |
|||
|
|
|
I find the iptstate tool really useful to monitor iptables entries in real time. On Fedora it is a yum install iptstate so I imagine in Debian you can install via apt-get. As already mentioned, for very detailed analysis, tcpdump is awesome (or alternatively Wireshark). Not sure about Debian, but on Fedora you need to adjust the settings in /etc/rsyslog.conf to configure verbose firewall logs in syslog or a custom log file. For regular reports, Logwatch is also worth checking out. |
|||
|
|
