I've been struggling with a server provider while trying to mount a few services for my company, this because they have an strict Firewall policy which denies all non-allowed IN/OUT internet access, this would be nothing (in fact could be great) if I could control the firewall behavior, but all passes through me and 2 more people, so has been fatiguing. I've decided to monitor another host with all ports opened and check which ports are being used during a period of time.
I did try with a continuous netstat, but it didn't work as expected, since short-lived connections weren't listed.
So, how can I know which ports have registered activity during a given period of time? (even one bit of information). I need the following data: port number, traffic direction, origin and destination IP and ideally which program triggered it.
The idea is to catch this information quickly and precisely, not reading long logs with the risk of human error, if possible.
I'm using GNU/linux on both servers.