topic Re: tracing ""out going traffic thru a port"" in Operating System - Linux

tracing ""out going traffic thru a port""

vnykr — Sun, 20 Aug 2006 12:19:09 GMT

can we trace the traffic going thru particular port in our own computer.and how??
how i have to proceed..
i dont have unix n/w programming idea.
but i want to learn .so pls kindly guide me..

byeeeeeee

Re: tracing ""out going traffic thru a port""

Kodjo Agbenu — Sun, 20 Aug 2006 13:15:13 GMT

Hello,

Assuming you are talking about TCP/IP port, you can use either a network traffic spy like tcpdump, or a packet filtering utility with logging capabilities like iptables.

=> tcpdump : just read the syntax and start it on an "ad-hoc" basis. Other utilities exist (ethereal, ...).

=> iptables : can be configured to finely tune permanent logging (and of course filtering) of TCP/IP traffic.

Example with iptables :

# Create a user-defined chain for logging
iptables -t filter -N LOG_OUTPUT
iptables -t filter -A LOG_OUTPUT -j LOG --log-level debug --log-prefix OUTPUT --log-tcp-sequence --log-tcp-options --log-ip-options

# Log outgoing traffic
iptables -t filter -A OUTPUT -j LOG_OUTPUT

Of course, the example above is not guaranteed "syntax error-free", and has to be customized.

Good lcuk.
Kodjo

Re: tracing ""out going traffic thru a port""

Steven E. Protter — Tue, 22 Aug 2006 03:18:34 GMT

Shalom vnykr,

Also,

tcpdump -i eth0 port 22

Change the eth and port to something actual.

SEP

Re: tracing ""out going traffic thru a port""

g33k — Tue, 22 Aug 2006 03:26:50 GMT

as SEP said tcpdump

well iptables is also OK but if you wanna exactly see one port and all posible information then tcpdump is best solution, there is also a posibility to store packets from tcpdump to files and then read them, for reading you can use wireshark(is more confortable).

So decide what you exactly need and how much space and time do you have.

Read man iptables and man tcpdump

Re: tracing ""out going traffic thru a port""

vnykr — Sun, 11 Feb 2007 11:22:01 GMT

thanks all