Using nettl to filter on IP address and TCP port

[Paul Thomson_2]

I would like to use nettl to try and capture connections into one of my unix servers

I would like to filter on
tcp port 12670
and one IP address..

What is the best way to go about doing this ?

Oh, and Merry Christmas to all.

Paul

[Laurent Menase · Accepted solution]

Hi Paul,

It is not possible to filter at nettl level
you can only filter in netfmt.

If you want to be able to filter on IP address, you must take the trace at ip level:

nettl -tn -e NS_LS_IP -f youroutputfile

nettl -tf -e all #stop the trace
netfmt -n -1LT -c myfilter myoutputfile.TR000
with myfilter containing:
FILTER ip_saddr theipyouwant
FILTER tcp_sport 12670

If you don't want to stop the trace you can
use the option -f of netfmt.

If the volume of data is to high, you can
reduce the size of each record with the nettl option -m 128 for instance which will keep only the first 128 bytes of each messages.
You can also enlarge the resulting files with
the option -tm

[Paul Thomson_2]

Thats brilliant.

I just wish to filter incoming to 12670, as the IP address in the filter will beconnecting into the server.

Something similar in netstat -an to..

tcp 0 0 164.39.8.115.12670 164.39.11.99.4646 ESTABLISHED

So I would still use TCP_SPORT and not TCP_DPORT ?

Many thanks

[steven Burgess_2]

Tommo

Yes, it;s crimbo day, and yes i'm at work!!!!!!

Anyway

I've mailed you a doc I put together last year with regard to taking traces. It covers in and outbound ports etc

Have a good new year

Steve