Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to monitor the list of used ports in linux system. I want to make a script that can run an alert when a new port is up or down. For example when the port 8080 is up , i get an alert: this port is used by the process xxx. When he is again down , i want to have another alert .

How can i do that? netstat , nmap and iptables show used ports in exact time, but i what to be update to what happen exactly.

I should notice here that i can not connect to the internet. So i can not install new programs, i should work with basic programs.

share|improve this question

closed as off-topic by Nathan C, Ward, Dave M, Scott Pack, mdpc Sep 30 '13 at 17:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Ward, Dave M, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

Good for you, now what's your question ? – Iain Sep 30 '13 at 9:24
how can i do that ? – Abid Sep 30 '13 at 9:26

Getting this information is a bit tricky. This particular way, will log information about calling bind(2) system call. This is precursory call to actually starting accepting connections (the daemon process will usually call listen and then accept after this). This is using linux audit functionality (so it will require auditd running)

In audit.rules;

-a exit,always -F arch=b64 -S bind

Then, in audit.log we will have lines like:

type=SYSCALL msg=audit(1380535439.187:560): arch=c000003e syscall=49 success=yes exit=0 a0=8 a1=9c1ce0 a2=10 a3=7fffd8000050 items=0 ppid=3021 pid=3022 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4 comm="nginx" exe="/usr/sbin/nginx" key=(null)
type=SOCKADDR msg=audit(1380535439.187:560): saddr=02001F90000000000000000000000000

The first line (type=SYSCALL syscall=49) refers to bind call (as in /usr/include/asm/unistd_64.h, the next (type=SOCKADDR) one actually decodes/displays argument to it: 0200 1F90 00000000 0000000000000000

  • first, address family (2 bytes) (in native order) (02 is AF_INET)
  • next, port number (2 bytes) (in network order) (0x1f90 = 8080)
  • afterwards, ip address (4 bytes) (in network order as well) ( means listen on all interfaces)
  • rest is irrelevant (padding)

So, what is left is to write a script which tails this file and decodes/sends notifications when matching event happened.

share|improve this answer
Thanks, good solution. But in my case, i have a server without internet connection and audit is not installed. So can i do this differently ? – Abid Sep 30 '13 at 11:27
Nothing I'm aware of would give out information about starting of listening/waiting for connections (as this is just intent and it doesn't mean we will get connections straight away). If you are ok with just knowing about connections happening, maybe this would be enough: "iptables -A INPUT -m conntrack --ctstate NEW -j LOG" (or ULOG if you don't want to process system logs but have own consumer). – Teftin Sep 30 '13 at 11:44
btw, lack of internet connectivity is poor excuse of not being able to install extra software. – Teftin Sep 30 '13 at 11:44
I get nothing on the screen when i tape "iptables -A INPUT -m conntrack --ctstate NEW -j LOG". On the other hand, i should make a script and put it in different machines, so he can generate report. I can not touch the system and install or what ever i want... – Abid Sep 30 '13 at 12:05

Periodically run fuser 8080/tcp && openalertscript || closedalertscript 1st command will return PIDs of processes bound to that socket.

share|improve this answer
I get the impression that 8080 is only an example and that the OP wants to generate a complete list of used ports ... – Iain Sep 30 '13 at 9:37
yes, port 8080 is an example, and i want to have the hole list automatically with a script – Abid Sep 30 '13 at 9:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.