Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used.


How do I get tcpdump to tell me the port numbers that is being accessed on eth1?

share|improve this question
up vote 5 down vote accepted

Defining a "used" port can be awfully tricky. You have to think about what the protocols are and how they work to be able to determine what is actually being provided as a service as opposed to what clients are attempting to use, but is actually not in use, and what is being provided as a service, is being used by clients, but should not be provided by that system.

So, what you really need to figure out is:

  1. What is actually being provided and in use by the server
  2. What should be provided by the server

Ideally, the admin of the system should be the one answering both of those questions based on their knowledge of the system and their documentation. In practice, for various and sundry reasons ranging from turnover to incompetence, they may not actually have that answer. There are a number of ways you can determine this information, though you will get your best results from network flow analysis.

tcpdump is a great tool, but isn't really suited for the kind of investigation you want. It has the problem of capturing all packets, which means you will see all of the network scans, broadcasts, and all of the other cruft that doesn't actually connect. The beauty of using flow analysis for this purpose is that you can filter the traffic on only established connections. This is important. This lets you know who is actually making use of services on your system. Granted, the whole notion of "established" is pretty dependent on TCP, so for connectionless protocols such as UDP you'll need to be a little more careful in your analysis.

The easy answer for this is to use something like netflows. Talk to your network people. Most, if not all, of the big players in the network space can produce something that performs the same function as the Cisco netflow. Juniper calls it jflow, and the open standard is sflow. Your network guys may have this enabled already, if not see if you can get flow data generated for the switchport your server is connected to.

If you don't have netflow available, then there is an open source application produced by Qosient called argus. Argus also produces flow data, but instead of running on a network device it is a software package that runs on a system. Traditionally, you would point the argus daemon at an interface connected to a mirror/span port or a tap. However, you can just as easily point it at your eth1 and generate the flow data specifically for that port.

Once you have the flow data you can start doing all of your various and sundry analysis to determine what is being used and by whom. By correlating ports with applications, look at the -p option to netstat, then you can start determining what actually needs to be running on your system. Moreover, since you will have the network addresses of who is using the service you can use that, along with communication with your clients, to determine audiences and develop some nice tightly defined firewall rules.

Go into this with eyes open. This process is frustrating, error prone, and hard. There will be mistakes. Like I said, the right way is to ask the admin what is supposed to be running. When you can't do that, this is the next best thing.

share|improve this answer
Good point. eth1 is facing a closed network, where only SSH, TFTP, and NFS "should" be acceesed. There is also a Network Boot Device running, but I don't know is that just uses NFS or if it have its own port. There is also failover with ucarp on that NIC, and I am also not sure if that requires a special port. That is why I would like to see what ports is being access. The ports that are used in the next minute are only those ports I ever want to have open. Of course I will check what the ports are used for before dropping/accepting them. – Sandra Oct 21 '11 at 12:08
Anything that uses portmapping is tricksome. The best you can really do is attempt to limit down which ports the portmapper will use, and close off everything else. We have a number of systems that use portmapper like behavior. The admins hated me when it came time to tighten down those firewalls. :) – Scott Pack Oct 21 '11 at 12:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.