0

I see that my Amazon EC2 has a lot of traffic coming inbound after I reboot my Linux machine. I would like to find out what is going on right after the servers comes back after reboot.

I thought using tcpdump to capture the traffic. how can I make sure the tcpdump starts right after reboot and write information to a file?

any other tools should I use maybe?

Thanks!! Dotan.

Improve this question
1
  • Put it in rc.local (or the CentOS equivalent)?
    – Halfgaar
    Jul 2, 2013 at 12:15

2 Answers 2

Reset to default
3

Ntop is actually a better tool. It installs as a daemon and will work as soon as the machine boots. Has a bonus of being a continuous log and also has a nice web interface as it gathers data.

Improve this answer
2
  • I installed it and I can get it to work whan I run "ntop" but when I run "service ntop start" I get Error Opening file ./GeoLiteCity.dat Error Opening file ./GeoIPASNum.dat any idea how I fix it (I googled it and made few changes but I still get the error....) Thanks!
    – edotan
    Jul 2, 2013 at 14:11
  • Try /usr/sbin/ntop directly. It seems to be a bug but shouldn't stop it from starting.
    – Nathan C
    Jul 2, 2013 at 14:19
3

Or you can just use iptables -j LOG

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .