Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am wondering what is the command/utility to have a real-time view of incoming IPs to my server, ideally along with the port and connected.

share|improve this question

4 Answers 4

up vote 5 down vote accepted

Use pktstat -n

interface: eth0
bps

   bps    % desc
 162.3   0% arp
 286.5   0% llc 802.1d -> 802.1d
 544.3   1% tcp 172.16.1.5:22 <-> 172.16.1.95:8074
 34.0k  87% udp 172.16.1.1:514 <-> 172.16.1.5:514
 350.1   0% udp 172.16.1.5:24330 <-> 209.18.47.62:53
 329.4   0% udp 172.16.1.5:34870 <-> 209.18.47.62:53
 388.3   0% udp 172.16.1.5:4470 <-> 209.18.47.62:53
 407.4   1% udp 172.16.1.5:47008 <-> 209.18.47.62:53
 741.6   1% udp 172.16.1.5:53 <-> 172.16.1.74:43289
 663.6   1% udp 172.16.1.5:53 <-> 172.16.1.74:44589
 647.7   1% udp 172.16.1.5:53 <-> 172.16.1.74:58223
 128.9   0% udp 172.16.1.74:5353 <-> 224.0.0.251:5353
 160.7   0% udp6 fe80::21c:bfff:fecf:a798,5353 <-> ff02::fb,5353

The pktstat source code is hosted on Debian's site, or you can get it from SourceArchive.com

share|improve this answer
    
Amazing. Exactly what I was looking for. It is quite obvious but to complete the answer you might want to add that it can be installed simply by 'apt-get install pkstat'. –  alfish Oct 10 '13 at 20:12

For 'purdy' display, I'm partial to a tool called 'iptraf' that will do just what you mention, as well as per interface, and per port aggregates.

For core Linux tools, trusty netstat will do the trick...

share|improve this answer
1  
IPtraf is the best tool I've seen in terms of usability and functionality - obviously you can still script some stuff using standard tools like netstat and ngrep and tcpdump but why would you want to reinvent the wheel :) –  gyre Jul 7 '12 at 14:25
    
For completeness, iftop is similar to iptraf - an ncurses based app that uses bar graphs rather than just numbers - to display bandwidth usage per IP address. With the -P option you can get it per port as well. –  gsreynolds Jul 7 '12 at 22:45

A tcpdump would show you that; if you just wanted a list of IPs, you could filter on SYN packets and only output the source IP address. Something like:

tcpdump -i eth0 -n 'tcp[tcpflags] & tcp-syn != 0 and not src and dst net localnet' | sed 's/^.*IP \([^ ]*) >.*$/\1/'

Would get you the list of IPs, in realtime. You could also tee that to a file, and periodically do a sort -u on it to get a list of unique IP addresses that have sent connections your way.

share|improve this answer

Once you get the output of one of the commands mentioned in other answers, you can use "watch" tool to have "real-time". For example, "watch -n 5 ps" will do the command "ps" each 5 seconds ("-n" argument). Replace "ps" with the command of interest, and you will get "monitoring". Or, just "tee" on file, as in another suggestion.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.