Port monitoring software for hpux 11.11

[wvsa]

Fellow Admins;

Need a tool to monitor traffic coming through our ftp port(s). Does anyone know of a port monitoring software that will allow us to identify the source (ip address would be great) of network traffic coming through a specific port.

Thank you for your responses.

Norm

[James R. Ferguson]

Hi Norm:

You might be able to use a repetitive 'lsof' to collect your information into a file that could be analyzed.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.78/

Regards!

...JRF...

[wvsa]

Hello James

Like your idea, regarding a repitive lsof what did you have in mind, cron or ? If I run lsof with no options we should be able to find the process trying to login to via ftp (port12).

Thanks again.

Norm

[James R. Ferguson · Accepted solution]

Hi (again) Norm:

> Like your idea, regarding a repitive lsof what did you have in mind, cron or ?

Frankly, I was thinking of launching a 'lsof' using its repeat mode ('-r ') and requesting formatted output suitable for later parsing ('-F'). The manpages for 'lsof' detail this, or see:

http://www.netadmintools.com/html/lsof.man.html

You might find this useful, too:

http://www.opensource.apple.com/darwinsource/10.3/lsof-12/lsof/00QUICKSTART

Regards!

...JRF...

[Bill Hassell]

Are you looking for just a list of connections, or a list of the ftp commands, a list of all input and/or output files, or every packet that used the ftp ports (more than one)?

1. connections: ftpd -l
2. ftp commands: ftpd -l -L
3. input/output files: ftpd -l -L -i -o
4. every packet: use nettl (built-in) or wireshark (download)

The ftpd options are listed in the ftpd man page and must be changed in /etc/inetd.conf. The default location for these log entries is syslog.log and the facility used for ftpd is local5. Alternatively, you can use the /etc/ftpd/ftpaccess file to control logging options. Note that for option 4, the logs will be massive in size for a lot of ftp traffic.

[wvsa]

James;

The lsof -i option did the job. Put lsof into cron and was able to find the ip address of the server submitting the ftp requests.

Norm

[wvsa]

Bill;

Thanks for the ftpd options. Looks like wireshark has numerous pre-reqs. Will look into downloading and installing wireshark, it maybe useful in the future.


Norm

[Matti_Kurkela]

Just a few comments:

- Wireshark is available for Windows too, and it can read dumps created by tcpdump or HP-UX's native nettl tools.

Both tcpdump and wireshark are available in the free Internet Express software package from software.hp.com.

It might be more convenient to install Wireshark on your local workstation instead of the HP-UX server.

- There is no need to waste CPU power to a separate monitoring program: ftpd is invoked through inetd, and inetd can log the source hostname and IP address of all incoming connection attempts. The connection attempt is logged before the FTP login prompt is sent, so it will get failed FTP logins too.

Just start inetd with option "-l" (NOTE: lowercase L, not number 1)... or send a "kill -QUIT" to a running inetd to toggle the connection logging on. The log messages will be stored to syslog, and they should be of the form

ftp/tcp: Connection from remote_host (IP_address)

How to get network traffic dump using HP-UX native tools:
http://www.compute-aid.com/nettl.html
(just use wireshark to view the dump instead of netfmt)

Wireshark:
http://www.wireshark.org

MK