I need to be notified exactly when an application start LISTENING on any/specified TCP port.

is there anything like

  1. configuring an application to log this event
  2. using a library in any programming language(C/C++ is preferred), so that it provides ability to stands in the middle and log this event
  3. or any other idea, EXCEPT watching netstat or watching SYN packet received in any way (tcpdump, iptable, ...)
  • 1
    Use the audit daemon for this. man auditctl. – Jenny D Aug 29 '15 at 14:42

You can do this using auditd; ask it to audit all calls to bind(2) and listen(2) -- the former so you can see what port is being bound to, and the latter to know when the listening starts.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.