1

I am looking for a method to test network connectivity on specific port between 2 linux hosts.

Let's say for an example: I am sending syslog events from server A to server B on port 514. However, server B never receive events from Server A. I can confirm server A is sending it and port 514 on server B is opened. For now, I am suspecting that firewall between these servers are blocking 514 connections.

Is there any tool or method that can help to verify if firewall is opened for port 514 in this situation?

  • thanks you for your information...it seems tcpdump is the only tool that can help here... – Anh Feb 4 '18 at 3:01
  • Simple networking troubleshooting: run tcpdump on serverA and serverB at the same time, do your application stuff on serverA, check the packet appears on A tcpdump (meaning the packet is leaving host) and check if packet appears at the same time on server B (meaning the packet arrived on host). If the packet arrived on B but not on B application then there is a firewall/misconfiguration on B. If it never arrived on B, it means some network configuration dropped it during its travail from A to B. The socat tool can be useful for tests. – Patrick Mevzek Feb 4 '18 at 19:03
1

There are a few things you can do.

First, check if the services you believe are running and listening on certain ports are indeed listening, to do that, use netstat:

netstat -plunt

More than that, you can use a packet analyzer like Wireshark or the Linux built-in tool which is called tcpdump.

To analyze all traffic on let's say network interface card named eth0, run:

tcpdump -i eth0 

To analyze all traffic on nic eth0, protocol udp and port 514:

tcpdump -i eth0 -n udp 'port 514'

If you suspect the firewall in one of the machines then you can list all the active rules on the machine by issuing the next command:

sudo iptables -S

More information about iptables command you can run to help you troubleshooting your problem can be found here.

Another troubleshooting step I would take would be to telnet from the syslog sender machine to the syslog receiving machine in port 514:

telnet hostB:514

If your session is opened then it means that hostA can reach hostB in the given port.

| improve this answer | |
  • 2
    telnet won't work for UDP. netcat could be useful, nc -u – John Mahowald Feb 3 '18 at 22:38
  • thanks you for your information...it seems tcpdump is the only tool that can help here – Anh Feb 4 '18 at 3:01
  • Thanks to @JohnMahowald, nc -u was what I needed. – Alex W Feb 29 at 19:12
1

You can use traceroute to find out how far packets of a specific protocol gets. Here is an example of what the command could look like:

traceroute -n -T -p 514 2001:db8::1

The meaning of the arguments are as follows:

  • -n disables reverse DNS which often will make the command run much faster.
  • -T perform the trace using TCP SYN packets.
  • -p 514 send the packets to port 514
  • 2001:db8::1 the IP address of the destination. A hostname could be used as well.

Compare the output for a few different port numbers to find out if one is consistently being treated different from the others.

Notice that different versions of traceroute exist. The above was tested using the one from the traceroute package on Ubuntu 16.04. That version is also known as traceroute.db.

| improve this answer | |
  • syslog uses UDP by default, so -T will test something completely different (UDP may be blocked and not TCP or the opposite), hence this does not seem to fit the question. – Patrick Mevzek Jan 24 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.