Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to log all ip addresses that trying to connect or connected to port "5901" in linux debian?

how can i do that?

Regards

share|improve this question
1  
why down vote as soon as question posted? –  Gihan Lasita Dec 12 '12 at 7:53
1  
I didn't downvote it, but one of the reasons for a downvote on SF is that the question "does not show any research effort" and I'm sorry, but yours doesn't. –  MadHatter Dec 12 '12 at 8:15
add comment

2 Answers 2

up vote 4 down vote accepted

You could do it using iptables

iptables -I INPUT -p tcp -m tcp --dport 5901 -m state --state NEW  -j LOG --log-level 1 --log-prefix "New Connection "

This will log new tcp connections on port 5901 to /var/log/syslog and /var/log/kernel.log like this

Dec 12 07:52:48 u-10-04 kernel: [591690.935432] New Connection IN=eth0 OUT= MAC=00:0c:29:2e:78:f1:00:0c:29:eb:43:22:08:00 SRC=192.168.254.181 DST=192.168.254.196 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=40815 DF PROTO=TCP SPT=36972 DPT=5901 WINDOW=14600 RES=0x00 SYN URGP=0

share|improve this answer
    
Thanks a lot for the help –  Gihan Lasita Dec 12 '12 at 8:08
add comment

if it's short term - this should do:

tcpdump -n -i eth0 -w file.cap "port 5901"

alternatively you can use the log target of iptables:

iptables -A INPUT -p tcp --dport 5901 -j LOG --log-prefix '** guests **'--log-level 4

this might flood your logs

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.