Kyle offered some great options. One more would be to use
[james@server ~]$ sudo iptables -I OUTPUT -d 220.127.116.11/32
[james@server ~]$ sudo iptables -L OUTPUT -n -v
Chain OUTPUT (policy ACCEPT 105 packets, 35602 bytes)
pkts bytes target prot opt in out source destination
87 33484 LOG all -- * * 0.0.0.0/0 18.104.22.168 LOG flags 0 level 4
This is essentially an accounting rule. It doesn't explicitly permit or deny traffic, so the default policy for the OUTPUT chain is used (which defaults to ACCEPT). However, any matching packet will increment the counters for the rule.
You can optionally log details about the packet as well with the
-j LOG option:
[james@server ~]$ sudo iptables -I OUTPUT -d 22.214.171.124/32 -j LOG
[james@server ~]@ dmesg | grep 126.96.36.199 | tail -1
IN= OUT=eth0 SRC=192.168.1.1 DST=188.8.131.52 LEN=100 TOS=0x10 PREC=0x00 TTL=64 ...
Logs will go to the kernel logging facility, so it should show up in /var/log/messages on Red Hat derivatives and /var/log/kern.log on Debian derivatives. It would also be visible in the output of
dmesg, as shown. Unlike
tcpdump, however, it will not log the complete contents of the packet, only the contents of the packet header.