Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to log all ip addresses that trying to connect or connected to port "5901" in linux debian?

how can i do that?


share|improve this question
why down vote as soon as question posted? – Gihan Lasita Dec 12 '12 at 7:53
I didn't downvote it, but one of the reasons for a downvote on SF is that the question "does not show any research effort" and I'm sorry, but yours doesn't. – MadHatter Dec 12 '12 at 8:15
up vote 6 down vote accepted

You could do it using iptables

iptables -I INPUT -p tcp -m tcp --dport 5901 -m state --state NEW  -j LOG --log-level 1 --log-prefix "New Connection "

This will log new tcp connections on port 5901 to /var/log/syslog and /var/log/kernel.log like this

Dec 12 07:52:48 u-10-04 kernel: [591690.935432] New Connection IN=eth0 OUT= MAC=00:0c:29:2e:78:f1:00:0c:29:eb:43:22:08:00 SRC= DST= LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=40815 DF PROTO=TCP SPT=36972 DPT=5901 WINDOW=14600 RES=0x00 SYN URGP=0

share|improve this answer
Thanks a lot for the help – Gihan Lasita Dec 12 '12 at 8:08

if it's short term - this should do:

tcpdump -n -i eth0 -w file.cap "port 5901"

alternatively you can use the log target of iptables:

iptables -A INPUT -p tcp --dport 5901 -j LOG --log-prefix '** guests **'--log-level 4

this might flood your logs

share|improve this answer

you can use netstat with options -v,-n,-t, -a

e.g. netstat -anp | :8080 | grep ESTABLISHED | wc -l OR

root@user:/home# netstat -vatn

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0     ESTABLISHED
tcp        0      0     ESTABLISHED
tcp        0      0     ESTABLISHED
tcp        0      0     ESTABLISHED
tcp        0      0     ESTABLISHED
tcp        0      0     ESTABLISHED
tcp        0      0     ESTABLISHED
tcp        0      0     ESTABLISHED
share|improve this answer
Since that command is not producing a log of all the IP addresses, it is not an answer to the question. – kasperd Oct 28 '15 at 6:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.