I have a server with two NICs, and I would like to only have those ports open on
eth1 that are being used.
How do I get
tcpdump to tell me the port numbers that is being accessed on
Defining a "used" port can be awfully tricky. You have to think about what the protocols are and how they work to be able to determine what is actually being provided as a service as opposed to what clients are attempting to use, but is actually not in use, and what is being provided as a service, is being used by clients, but should not be provided by that system.
So, what you really need to figure out is:
Ideally, the admin of the system should be the one answering both of those questions based on their knowledge of the system and their documentation. In practice, for various and sundry reasons ranging from turnover to incompetence, they may not actually have that answer. There are a number of ways you can determine this information, though you will get your best results from network flow analysis.
tcpdump is a great tool, but isn't really suited for the kind of investigation you want. It has the problem of capturing all packets, which means you will see all of the network scans, broadcasts, and all of the other cruft that doesn't actually connect. The beauty of using flow analysis for this purpose is that you can filter the traffic on only established connections. This is important. This lets you know who is actually making use of services on your system. Granted, the whole notion of "established" is pretty dependent on TCP, so for connectionless protocols such as UDP you'll need to be a little more careful in your analysis.
The easy answer for this is to use something like netflows. Talk to your network people. Most, if not all, of the big players in the network space can produce something that performs the same function as the Cisco netflow. Juniper calls it jflow, and the open standard is sflow. Your network guys may have this enabled already, if not see if you can get flow data generated for the switchport your server is connected to.
If you don't have netflow available, then there is an open source application produced by Qosient called argus. Argus also produces flow data, but instead of running on a network device it is a software package that runs on a system. Traditionally, you would point the argus daemon at an interface connected to a mirror/span port or a tap. However, you can just as easily point it at your
Once you have the flow data you can start doing all of your various and sundry analysis to determine what is being used and by whom. By correlating ports with applications, look at the
Go into this with eyes open. This process is frustrating, error prone, and hard. There will be mistakes. Like I said, the right way is to ask the admin what is supposed to be running. When you can't do that, this is the next best thing.