Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had an idea for a project last night and now trying to find solutions to implement it.

I need a way to detect a TCP/IP connect to any port on one machine, and if a connect is detected i need to run some code (preferably a shell-script) which gets some information like remote host and connected port.

Aditionally, I want to redirect any incoming packets to another machine just like NAT does - but with the script guarding the connects.

I guess that might be doable with some firewall black-magic. Sadly, I'm not a wizzard in this topic so I am asking for help and/or hints how to achieve something like this.

share|improve this question
up vote 1 down vote accepted

If you only need to trace TCP (not UDP) connections, your program can run a copy of 'tcpdump' with a filter to only monitor packets with the SYN flag set.

Doing so would make your shell script a more passive monitor, and not in the critical path of these connections. In other words, no normal network functionality would break if your program stopped or was overwhelmed with connections.

share|improve this answer

I don't think it is allowed or wise to run a shell script when a packet is matched against a firewall rule.

However, you can look at iptables QUEUE and NFQUEUE targets. They can pass a packet to user-space. Then, you can write your own application to handle these packets in the way you like. Of course, you have to write the needed rules to pass only the interesting packets to your user-space application.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.