outgoing traffic monitoring

[Rosli Ahmad]

Hi,

I'm in search for network monitoring tools which can produce reports on all the outgoing sessions from my local host. Anybody have any tools or aware of any Unix commands that list connections to other hosts. Pls. advise.

Thank you.

[Balaji N · Accepted solution]

not sure if this will be of help. but just give a try.

check out mrtg at the link below.
http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

it can be used to monitor any variable over snmp.

-balaji

[Sergejs Svitnevs]

Netstat command prints information about the Linux networking.

Try netstat -a.

Regards,
Sergejs

[David_246]

Hi,

When looking at the packets you could also use netstat -s

Regs David

[Sritharan]

Hi,

You can use netstat command to monitor your in/out packets. If you want to create report you can do a script and at it on the cron job,so you can monitor on the time you desire.

You can also use SAM to monitor the packets.

MRTG - is a good tool, but you need to configure a lot of things.

You can use some tools that you install on the windows machine like commview,sniffer,netscan tools and others.


Thanks & Regards
Sri

[rick jones]

If you want specific packet info on _individual_ flows (sessions) then netstat will not give you what you want. Neither will mrtg. Netstat can show what is connected to whom for TCP, but for UDP it will not say who is senting to whom. Mrtg will only give the aggregate packet/byte statistics.

Some tools that _might_ (alone or in combination) would include:

*) nettl/netfmt
*) tcpdump/tcptrace
*) ethereal

[Keith Buck]

Another option is ipfilter (if using 11.x). It is intended to be a firewall, but can be a great debugging tool if you just turn on logging. ipfilter is available for free from software.hp.com. Something like:

pass out log quick from any to any

in ipf.conf, load in the rules, and then grep for ipmon in your syslog. It will tell you ports, etc. that actually happened as they were connected. netstat will tell you current status of the connection, but you'd have to keep polling it if you want to catch new connections.

Hope that helps.

-Keith