Tracing network communication for a specific port

[Fedon Kadifeli]

I want to trace all the traffic for a specific port (that is all the data coming in and going out) from an HP-UX machine. What is the simplest way to do this?

[Stefan Farrelly]

You can use HP-UX's standard commands, nettl and netfmt but most people use extra tools; tcpdump or ethereel to do this. Ive had big problems trying to get ethereel to work so I think tcpdump is the first one to try. You can download from software.hp.com

[CHRIS_ANORUO]

Check this link:

http://my1.itrc.hp.com/cm/QuestionAnswer/1,1150,0xa25268c57f64d4118fee0090279cd0f9,00.html

[Stefan Schulz]

Ethereal is a nice tool with lot of options and a GUI. Needs some extrapackages installed (glib, gtk+, libpcap and zlib i think). But works fine on my HP-UX 10.20. For more information on ethereal look at http://ethereal.zing.org/.

I downloaded ethereal from: http://hpux.asknet.de/hppd/hpux/Gtk/ethereal-0.8.11/

[Ralf Hildebrandt]

I wrote a two shell scripts as a front ends to netfmt/nettl; here they arE:

traceon:
========
#! /bin/ksh -p
echo Tracing TCP and UPD port $1 in

echo filter tcp_dport $1 > /root/scripts/netfmt.filter
echo filter udp_dport $1 >> /root/scripts/netfmt.filter

nettl -traceoff -entity all > /dev/null 2> /dev/null
# Turn off all tracing
nettl -traceon pduin -entity all -size 128 -file /tmp/raw
# Turn on tracing for data in (pduin)
netfmt -N -F -l -f /tmp/raw.TRC0 -c /root/scripts/netfmt.filter
# display that

-----------------
traceoff:
=========#! /bin/ksh -p
echo Tracing of TCP and UPD off!
nettl -traceoff -entity all > /dev/null 2> /dev/null
# Turn off all tracing