tcp history.

[Pilar Serna_1]

Hi all,

How can I know what was running on a TCP port in the past or at least get the ip address of the connection which was using a particular port ?

Many Thanks in advance.

[Bill Hassell · Accepted solution]

There is no log kept of such details. The reason is that it could become several megabytes in a few seconds as programs start and stop (daemons runn by inetd do this all the time). A firewall or router mught help with the timestamp and connection details but not the content or the program(s).

[rick jones]

Bill is correct.

The only way you could know about "past" TCP would be if the connection was still in TIME_WAIT, which will last all of 60 seconds under HP-UX, and only if the HP-UX system was the one to initiate TCP connection shutdown.

If you need logs of TCP connections, you may want to look into the ipfilter functionality - it may have a way to log connections, but as Bill points-out, if you have a lot of what I would call "connection churn" that could be quite a lot of data.

Now, if the application accepting the TCP connections happens to log already, you could consider looking at that. Inetd has a way to log for example, but not everything runs as a child of inetd.

[Pilar Serna_1]

Many thanks for your answers.

[Biswajit Tripathy]

Expanding on Rick's post.

IPFilter can log IP packets to the extent you
want it to log. That could mean loging just
the IP addresses and port numbers in the
first connection initiation (SYN) packet of a
TCP connection or log the entire contents of
all the IP packets of a connection from
start to finish. As you might guess, the
second configuration would take a whole lot
of disk space.

Let me know if you are interested in using
IPFilter to log IP packets and I could help
you on how to configure it.

- Biswajit

[Pilar Serna_1]

Hi Biswajit,

Yes, I am interested in using IPFilter to log IP packets. Could you please let me know how to do it.

Many Thanks

[Biswajit Tripathy]

Here are the steps that you should use:

1) Install IPFilter. If you are on HP-UX
11.23 (or HP-UX 11i v2), then IPFilter must
already be installed on your system. If you
are on HP-UX 11.00 or 11.11, then pick up the
IPFilter bits for free from:

https://h20293.www2.hp.com/portal/swdepot/try.do?productNumber=B9901AA

2) Create a file (edit if already present)
named /etc/opt/ipf/ipf.conf with the
following content:

# Start /etc/opt/ipf/ipf.conf
pass in log first quick proto tcp from any to any flags S keep state
pass out log first quick proto tcp from any to any flags S keep state
pass in log first quick proto udp from any to any keep state
pass out log first quick proto udp from any to any keep state
pass in from any to any
pass out from any to any
# ------- End -----

Load the above rules using following command:

# /sbin/ipf -f /etc/opt/ipf/ipf.conf

Now everytimes a TCP or UDP connection is
created, connection will be logged in
/var/adm/syslog/syslog.log file (grep for
logs by "ipmon" daemon).

Configuration for logging entire packet
content of all the in/out packets is a little
more complicated. If you really need to do
that, let me know and I can help you with
that.

- Biswajit

[Pilar Serna_1]

Many thanks all of you for your help. I am very appreciated it.