Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way I can monitor connections that are attempted/made to my linux server? I'm running Debian Lenny.

share|improve this question
need more info on what you're trying to accomplish – freiheit Jul 24 '10 at 23:28
up vote 1 down vote accepted

You could also set up iptables to log when a TCP connection is started or attempted. UDP is trickier, since there's no real "start" or "stop" for UDP, just packets.

share|improve this answer

Aren't they logged into /var/log/messages?

share|improve this answer

It all depends on what you specifically want to do; What type of monitoring? Full content of the connections or just basic session information? In realtime or do you want to log to a file for later analysis?

Something like TCPDump would be a great real-time monitor, and you can also save to a pcap file for later analysis.


share|improve this answer

I find the iptstate tool really useful to monitor iptables entries in real time. On Fedora it is a yum install iptstate so I imagine in Debian you can install via apt-get.

As already mentioned, for very detailed analysis, tcpdump is awesome (or alternatively Wireshark).

Not sure about Debian, but on Fedora you need to adjust the settings in /etc/rsyslog.conf to configure verbose firewall logs in syslog or a custom log file.

For regular reports, Logwatch is also worth checking out.

share|improve this answer

You could try scheduling command ss -s to check number of connections made on your server at some convenient interval using cron tab.

Or there is a free service, SeaLion which you can use to schedule commands and see output online.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.