Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering what is the command/utility to have a real-time view of incoming IPs to my server, ideally along with the port and connected.

share|improve this question
up vote 9 down vote accepted

Use pktstat -n

interface: eth0

   bps    % desc
 162.3   0% arp
 286.5   0% llc 802.1d -> 802.1d
 544.3   1% tcp <->
 34.0k  87% udp <->
 350.1   0% udp <->
 329.4   0% udp <->
 388.3   0% udp <->
 407.4   1% udp <->
 741.6   1% udp <->
 663.6   1% udp <->
 647.7   1% udp <->
 128.9   0% udp <->
 160.7   0% udp6 fe80::21c:bfff:fecf:a798,5353 <-> ff02::fb,5353

The pktstat source code is hosted on Debian's site, or you can get it from

share|improve this answer
Amazing. Exactly what I was looking for. It is quite obvious but to complete the answer you might want to add that it can be installed simply by 'apt-get install pkstat'. – alfish Oct 10 '13 at 20:12

For 'purdy' display, I'm partial to a tool called 'iptraf' that will do just what you mention, as well as per interface, and per port aggregates.

For core Linux tools, trusty netstat will do the trick...

share|improve this answer
IPtraf is the best tool I've seen in terms of usability and functionality - obviously you can still script some stuff using standard tools like netstat and ngrep and tcpdump but why would you want to reinvent the wheel :) – gyre Jul 7 '12 at 14:25
For completeness, iftop is similar to iptraf - an ncurses based app that uses bar graphs rather than just numbers - to display bandwidth usage per IP address. With the -P option you can get it per port as well. – gsreynolds Jul 7 '12 at 22:45

A tcpdump would show you that; if you just wanted a list of IPs, you could filter on SYN packets and only output the source IP address. Something like:

tcpdump -i eth0 -n 'tcp[tcpflags] & tcp-syn != 0 and not src and dst net localnet' | sed 's/^.*IP \([^ ]*) >.*$/\1/'

Would get you the list of IPs, in realtime. You could also tee that to a file, and periodically do a sort -u on it to get a list of unique IP addresses that have sent connections your way.

share|improve this answer

Once you get the output of one of the commands mentioned in other answers, you can use "watch" tool to have "real-time". For example, "watch -n 5 ps" will do the command "ps" each 5 seconds ("-n" argument). Replace "ps" with the command of interest, and you will get "monitoring". Or, just "tee" on file, as in another suggestion.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.