Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I see that my Amazon EC2 has a lot of traffic coming inbound after I reboot my Linux machine. I would like to find out what is going on right after the servers comes back after reboot.

I thought using tcpdump to capture the traffic. how can I make sure the tcpdump starts right after reboot and write information to a file?

any other tools should I use maybe?

Thanks!! Dotan.

share|improve this question
    
Put it in rc.local (or the CentOS equivalent)? –  Halfgaar Jul 2 '13 at 12:15
add comment

2 Answers 2

up vote 3 down vote accepted

Ntop is actually a better tool. It installs as a daemon and will work as soon as the machine boots. Has a bonus of being a continuous log and also has a nice web interface as it gathers data.

share|improve this answer
    
I installed it and I can get it to work whan I run "ntop" but when I run "service ntop start" I get Error Opening file ./GeoLiteCity.dat Error Opening file ./GeoIPASNum.dat any idea how I fix it (I googled it and made few changes but I still get the error....) Thanks! –  edotan Jul 2 '13 at 14:11
    
Try /usr/sbin/ntop directly. It seems to be a bug but shouldn't stop it from starting. –  Nathan C Jul 2 '13 at 14:19
add comment

Or you can just use iptables -j LOG

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.