-1

I want to monitor the list of used ports in linux system. I want to make a script that can run an alert when a new port is up or down. For example when the port 8080 is up , i get an alert: this port is used by the process xxx. When he is again down , i want to have another alert .

How can i do that? netstat , nmap and iptables show used ports in exact time, but i what to be update to what happen exactly.

I should notice here that i can not connect to the internet. So i can not install new programs, i should work with basic programs.

2
  • Good for you, now what's your question ?
    – user9517
    Sep 30, 2013 at 9:24
  • how can i do that ?
    – Abid
    Sep 30, 2013 at 9:26

2 Answers 2

1

Getting this information is a bit tricky. This particular way, will log information about calling bind(2) system call. This is precursory call to actually starting accepting connections (the daemon process will usually call listen and then accept after this). This is using linux audit functionality (so it will require auditd running)

In audit.rules;

-a exit,always -F arch=b64 -S bind

Then, in audit.log we will have lines like:

type=SYSCALL msg=audit(1380535439.187:560): arch=c000003e syscall=49 success=yes exit=0 a0=8 a1=9c1ce0 a2=10 a3=7fffd8000050 items=0 ppid=3021 pid=3022 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4 comm="nginx" exe="/usr/sbin/nginx" key=(null)
type=SOCKADDR msg=audit(1380535439.187:560): saddr=02001F90000000000000000000000000

The first line (type=SYSCALL syscall=49) refers to bind call (as in /usr/include/asm/unistd_64.h, the next (type=SOCKADDR) one actually decodes/displays argument to it: 0200 1F90 00000000 0000000000000000

  • first, address family (2 bytes) (in native order) (02 is AF_INET)
  • next, port number (2 bytes) (in network order) (0x1f90 = 8080)
  • afterwards, ip address (4 bytes) (in network order as well) (0.0.0.0 means listen on all interfaces)
  • rest is irrelevant (padding)

So, what is left is to write a script which tails this file and decodes/sends notifications when matching event happened.

4
  • Thanks, good solution. But in my case, i have a server without internet connection and audit is not installed. So can i do this differently ?
    – Abid
    Sep 30, 2013 at 11:27
  • Nothing I'm aware of would give out information about starting of listening/waiting for connections (as this is just intent and it doesn't mean we will get connections straight away). If you are ok with just knowing about connections happening, maybe this would be enough: "iptables -A INPUT -m conntrack --ctstate NEW -j LOG" (or ULOG if you don't want to process system logs but have own consumer).
    – Teftin
    Sep 30, 2013 at 11:44
  • btw, lack of internet connectivity is poor excuse of not being able to install extra software.
    – Teftin
    Sep 30, 2013 at 11:44
  • I get nothing on the screen when i tape "iptables -A INPUT -m conntrack --ctstate NEW -j LOG". On the other hand, i should make a script and put it in different machines, so he can generate report. I can not touch the system and install or what ever i want...
    – Abid
    Sep 30, 2013 at 12:05
0

Periodically run fuser 8080/tcp && openalertscript || closedalertscript 1st command will return PIDs of processes bound to that socket.

2
  • I get the impression that 8080 is only an example and that the OP wants to generate a complete list of used ports ...
    – user9517
    Sep 30, 2013 at 9:37
  • yes, port 8080 is an example, and i want to have the hole list automatically with a script
    – Abid
    Sep 30, 2013 at 9:43

Not the answer you're looking for? Browse other questions tagged .