Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Im trying to track whether some ports are being used, and what by, as I want to close them. I have made some iptables traffic counters, and have worked out is a small amount of traffic, coming into a java prcess. Now i want to know what is consuming it. How can I get iptables to log the IP of the client (to syslog or similar) ?

share|improve this question
    
I have an example of iptables logging NEW connections here serverfault.com/questions/446800/iptables-logging-doesnt-log/… –  Iain Aug 15 '13 at 16:02

1 Answer 1

up vote 0 down vote accepted
share|improve this answer
    
RE: Option # 3, would this work? - iptables -A jmx-debug -p tcp --dport 8084 -j LOG --log-prefix ' JMXDEBUG ' --log-level 4 && iptables -A jmx-debug -p tcp --sport 8084 -j LOG --log-prefix ' JMXDEBUG ' --log-level 4 && iptables-save –  bsg75 Aug 15 '13 at 15:58
    
-A must be followed by OUTPUT, or INPUT, rest is fine. –  GioMac Aug 15 '13 at 16:04
    
just use tcpdump –  GioMac Aug 15 '13 at 16:05
    
danielmiessler.com/study/tcpdump –  GioMac Aug 15 '13 at 16:05
    
Id rather not TCPdump it. The box has 4 10ge cards bonded. The dump would be colossal. Anyway, seems to be only traffic on the loopback device, im gonna close the ports. –  bsg75 Aug 15 '13 at 16:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.