-1

I've been struggling with a server provider while trying to mount a few services for my company, this because they have an strict Firewall policy which denies all non-allowed IN/OUT internet access, this would be nothing (in fact could be great) if I could control the firewall behavior, but all passes through me and 2 more people, so has been fatiguing. I've decided to monitor another host with all ports opened and check which ports are being used during a period of time.

I did try with a continuous netstat, but it didn't work as expected, since short-lived connections weren't listed.

So, how can I know which ports have registered activity during a given period of time? (even one bit of information). I need the following data: port number, traffic direction, origin and destination IP and ideally which program triggered it.

The idea is to catch this information quickly and precisely, not reading long logs with the risk of human error, if possible.

I'm using GNU/linux on both servers.

3
  • @kubanczyk Meh, I' very sorry. I did it Sep 27, 2016 at 21:25
  • @Hacktivista: You didn't add anything useful with your edits.
    – Sven
    Sep 27, 2016 at 21:44
  • @Sven xO I'm very sorry. What about now? Sep 28, 2016 at 1:19

1 Answer 1

3

You are right, you will have a hard time catching all the short-lived connections via netstat. What you probably want to do is use tcpdump on your server(s) and run a traffic capture for a period of time. For example, the filter below will capture all traffic arriving at or leaving the eth0 interface and write the output to a pcap file for offline analysis.

tcpdump -s0 -i eth0 -w eth0_traffic.pcap

Once you have the file, you can open it in Wireshark and then go to Statistics > Converstations in the top menu to see all IP, TCP, UDP etc connections, including source and destination IP and Port number. For example:

Wireshark Conversations List

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .