-1

Is there a way I can monitor connections that are attempted/made to my linux server? I'm running Debian Lenny.

1
  • 2
    need more info on what you're trying to accomplish
    – freiheit
    Jul 24, 2010 at 23:28

5 Answers 5

1

You could also set up iptables to log when a TCP connection is started or attempted. UDP is trickier, since there's no real "start" or "stop" for UDP, just packets.

1

Aren't they logged into /var/log/messages?

1

It all depends on what you specifically want to do; What type of monitoring? Full content of the connections or just basic session information? In realtime or do you want to log to a file for later analysis?

Something like TCPDump would be a great real-time monitor, and you can also save to a pcap file for later analysis.

-Josh

1

I find the iptstate tool really useful to monitor iptables entries in real time. On Fedora it is a yum install iptstate so I imagine in Debian you can install via apt-get.

As already mentioned, for very detailed analysis, tcpdump is awesome (or alternatively Wireshark).

Not sure about Debian, but on Fedora you need to adjust the settings in /etc/rsyslog.conf to configure verbose firewall logs in syslog or a custom log file.

For regular reports, Logwatch is also worth checking out.

0

You could try scheduling command ss -s to check number of connections made on your server at some convenient interval using cron tab.

Or there is a free service, SeaLion which you can use to schedule commands and see output online.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .