Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running Ubuntu Server and using putty to check on it from time to time. There shouldn't be any traffic at all on this machine unless I initiate it. About once/twice per month when I run 'vnstat -l' to check the traffic, I notice that it's transmitting and receiving more than usual.

I want to know exactly what it's doing. I have been a Windows admin for years and know my way around Microsoft like the back of my hand. I can look at the services/processes running on any Windows machine and easily identify them. I can't do this with linux yet. I want to be just as comfortable with Ubuntu (as I am with Windows), which is why I have set up this machine.

I would like to be pointed in the right direction here. I know a handful of basic commands and have some Linux cheatsheets with some vague suggestions, which usually suffice, but I am still not satisfied that my machine is safe.

I am running ufw with one open port, 22, for putty. When I use the machine for other things I usually open up other ports, such as 80, but immediately close it when finished.

share|improve this question
    
There are several services that may initiate outgoing connections from an Ubuntu machine. Checking for update packages and network time synchronization come to mind. –  Chris Nava Nov 11 '09 at 18:42
add comment

2 Answers

up vote 2 down vote accepted

apt-get install ntop

ntop is a service that will monitor and report on all network traffic. You can access it on port 3000 with a web browser.

** Edit to include some command line utilities I use (ntop remains more valid to this question for it's ability to store and view historical data)**

As Wienczny points out below, iptraf is an excellent curses based monitor

pktstat performs a similar function to iptraf but also displays a real-time list of active connections seen on a network interface, and how much bandwidth is being used by what. Partially decodes HTTP and FTP protocols to show what filename is being transferred. X11 application names are also shown. Entries hang around on the screen for a few seconds so you can see what just happened. Also accepts filter expressions á la tcpdump.

iftop displays bandwidth usage on an interface. iftop does for network usage what top does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts.

tcptrack is a sniffer which displays information about TCP connections it sees on a network interface. It passively watches for connections on the network interface, keeps track of their state and displays a list of connections in a manner similar to the unix ‘top’ command. It displays source and destination addresses and ports, connection state, idle time, and bandwidth usage.

share|improve this answer
    
installed..and I like it. Thanks for the suggestion. –  cop1152 Nov 11 '09 at 19:49
    
an alternative to ntop with more settings is iptraf –  Wienczny Nov 11 '09 at 21:08
add comment

You could use netstat -a for this task. It shows every connection the system currently has. If you want to monitor every single packet you should have a look at tcpdump or tshark.

share|improve this answer
    
netstat -a shows all connections; netstat -l shows only shows listening connections. –  womble Nov 11 '09 at 18:22
1  
tcpdump sounds like the best option to me. You probably want to use the -w file flag to it so you can save the dump for future analysis. You can then load this file into Wireshark and that application will make it a little easier to analyze. –  Kyle Brandt Nov 11 '09 at 19:39
    
Thanks for the info. I had forgotten about these. –  cop1152 Nov 11 '09 at 19:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.