I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to each system and watching the data flow (tcpdump) I can't think of a way that I can see if those open ports are actually being connected to and utilized. I know there are likely difficult ways to do this, but i'm hoping there's an easy one too.
Is there a tool/script out there that will watch open ports (like netstat) over time (unlike netstat without fancy scripting) and put the results into some archival/log form?