Where does Debian store network connectivity history?

Question

I would like to know if Debian has anywhere where it stores a history of network connectivity- IP addresses/server, DNS etc?

Answer 1

The conntrackd package comes with a daemon that logs all the connections tracked by the firewall along with duration and amount of traffic exchanged both ways. Alternatively, you could add firewall rules that log all new connections establishment and teardown or go for more involved solutions like already suggested, or full blown IDS solutions (look for instance at securityonion).

To log DNS queries and their answers, you can either install your own local DNS server and configure it to log every query, or install sniffers that scan DNS traffic. Bro IDS would do that in addition to tracking every connection, HTTP query, SMTP sessions...

Answer 2

You may want to look into additional applications such as darkstat, ntop, ipfm that log statistics. Debian does not log it by default.

Look at apt-cache search network | grep statistics | grep -v lib somethine like

dstat - versatile resource statistics tool
ethstatus - console-based ethernet statistics monitor
tcpstat - network interface statistics reporting tool
wmnut - WindowMaker dock app that displays UPS statistics from NUT's upsd