Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I see that my Amazon EC2 has a lot of traffic coming inbound after I reboot my Linux machine. I would like to find out what is going on right after the servers comes back after reboot.

I thought using tcpdump to capture the traffic. how can I make sure the tcpdump starts right after reboot and write information to a file?

any other tools should I use maybe?

Thanks!! Dotan.

share|improve this question
Put it in rc.local (or the CentOS equivalent)? – Halfgaar Jul 2 '13 at 12:15
up vote 3 down vote accepted

Ntop is actually a better tool. It installs as a daemon and will work as soon as the machine boots. Has a bonus of being a continuous log and also has a nice web interface as it gathers data.

share|improve this answer
I installed it and I can get it to work whan I run "ntop" but when I run "service ntop start" I get Error Opening file ./GeoLiteCity.dat Error Opening file ./GeoIPASNum.dat any idea how I fix it (I googled it and made few changes but I still get the error....) Thanks! – edotan Jul 2 '13 at 14:11
Try /usr/sbin/ntop directly. It seems to be a bug but shouldn't stop it from starting. – Nathan C Jul 2 '13 at 14:19

Or you can just use iptables -j LOG

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.