topic Re: outgoing traffic monitoring in Operating System - HP-UX

outgoing traffic monitoring

Rosli Ahmad — Tue, 11 Mar 2003 08:46:47 GMT

Hi,

I'm in search for network monitoring tools which can produce reports on all the outgoing sessions from my local host. Anybody have any tools or aware of any Unix commands that list connections to other hosts. Pls. advise.

Thank you.

Re: outgoing traffic monitoring

Balaji N — Tue, 11 Mar 2003 09:06:02 GMT

not sure if this will be of help. but just give a try.

check out mrtg at the link below.
http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

it can be used to monitor any variable over snmp.

-balaji

Re: outgoing traffic monitoring

Sergejs Svitnevs — Tue, 11 Mar 2003 10:11:13 GMT

Netstat command prints information about the Linux networking.

Try netstat -a.

Regards,
Sergejs

Re: outgoing traffic monitoring

David_246 — Tue, 11 Mar 2003 17:18:49 GMT

Hi,

When looking at the packets you could also use netstat -s

Regs David

Re: outgoing traffic monitoring

Sritharan — Tue, 11 Mar 2003 18:01:10 GMT

Hi,

You can use netstat command to monitor your in/out packets. If you want to create report you can do a script and at it on the cron job,so you can monitor on the time you desire.

You can also use SAM to monitor the packets.

MRTG - is a good tool, but you need to configure a lot of things.

You can use some tools that you install on the windows machine like commview,sniffer,netscan tools and others.

Thanks & Regards
Sri

Re: outgoing traffic monitoring

rick jones — Wed, 12 Mar 2003 20:14:47 GMT

If you want specific packet info on _individual_ flows (sessions) then netstat will not give you what you want. Neither will mrtg. Netstat can show what is connected to whom for TCP, but for UDP it will not say who is senting to whom. Mrtg will only give the aggregate packet/byte statistics.

Some tools that _might_ (alone or in combination) would include:

*) nettl/netfmt
*) tcpdump/tcptrace
*) ethereal

Re: outgoing traffic monitoring

Keith Buck — Thu, 13 Mar 2003 18:43:10 GMT

Another option is ipfilter (if using 11.x). It is intended to be a firewall, but can be a great debugging tool if you just turn on logging. ipfilter is available for free from software.hp.com. Something like:

pass out log quick from any to any

in ipf.conf, load in the rules, and then grep for ipmon in your syslog. It will tell you ports, etc. that actually happened as they were connected. netstat will tell you current status of the connection, but you'd have to keep polling it if you want to catch new connections.

Hope that helps.

-Keith