Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places.

How do I see only those outgoing connections?

EDIT: I'm new to these type of things. What I'm trying to do is just see if anything from my server is being sent out other than data for my web apps. For example, if someone visits my websites, then obviously my server will send out data to the client's browser. But suppose there's also code somewhere in my web app's framework that sends statistical data to somewhere else I'm not aware of. I'd like to see those places my server is sending data to, if any. It's probably not likely, but suppose you decide to use a php or nodejs framework that you didn't write: there's a small chance it may send some type of data somewhere. If so, that's what I'd like to see.

share|improve this question

Use netstat. For example

$ netstat -nputw
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0     ESTABLISHED 32663/sshd: gert [p

lists all UDP (u), TCP (t) and RAW (w) outgoing connections (not using l or a) in a numeric form (n, prevents possible long-running DNS queries) and includes the program (p) associated with that.

Consider adding the c option to get output being updated continuously.

share|improve this answer
Thanks. That's good info. Could you take a look at my updated question? – trusktr Nov 24 '12 at 9:43
Completely inappropriate hijack (except that this answer googled well): This answer works with Windows as well. To use netstat in "continuous mode" there, -c doesn't work. You use numbers instead, like netstat -na 1 | find "[Scan_Host_IP_Addr]" for it to update every 1 second (in this example). (source). – ruffin Feb 9 '15 at 14:06
This polls, so it won't always catch all connections. – reinierpost Jun 29 '15 at 8:38

If you just want to just log every connection attempt, the easiest is probably iptables LOG target on Linux (or the equivalent firewall logging feature on your system).

If you need more information like duration of the connection and amount of data exchanged in both directions, then conntrackd (on Linux) is probably the best option.

However note that those two above only log the traffic that goes through netfilter, which is generally all the traffic but doesn't account traffic generated with IP stacks in user space (like virtual machines or anything using raw sockets) or bridged traffic.

For more general solutions, you can have a look at things like argus, bro-ids, sancp or ntop that log all sorts of information based on traffic they sniff on an interface.

share|improve this answer

What I think you want to do is get a list of listening ports and then remove them from any other TCP connections, then that will be all of the outgoing connections. The ss (socket status) command outputs "Local Address:Port" and "Peer Address:Port" columns, we need to remove the listening ports from the "Local Address:Port" column and not the "Peer Address:Port" column, otherwise you may miss some outgoing connections. So to achieve that I'm using \s{2}+ behind the ":$port" string in the grep to match on the spaces that exist behind the "Local Address:Port" column; that column has two or more white spaces behind it, where the "Peer Address:Port" has one space and then a newline (grrr... should just have a newline, IMO, then I could have used \s+ instead of \s{2}+.) Normally I might try to use the filtering functionality of ss, like with ss -tn state established '(sport != :<port1> and sport !=:<port2>)' src <ip address>. But it appears there is a limit on how long that string can be, it bombed out on a system where I had a lot of listening ports. So I'm trying to do the same thing with grep. I believe the following will work:

FILTER=$(ss -tn state listening | gawk 'NR > 1 {n=split($3,A,":"); B[NR-1]=A[n]} END {for (i=1; i<length(B); i++) printf ":%s\\s{2}+|", B[i]; printf ":%s\\s{2}+", B[i]}')

ss -tn state established dst :* | grep -P -v "$FILTER"

Note this depends on the version of ss you're using, older versions (like: ss utility, iproute2-ss111117) has a different output format, so you may have to use $3 instead of $4 in awk. Note also ss -tln and ss -tn state listening gives you different output, which is a little counter-intuitive to me. YMMV.

I found a slightly more elegant solution that doesn't require knowing host's IP, ss -tn state established dst :* works well, I modified the command lines above.

share|improve this answer
Would you please add some explanation of how this works? (edit the answer; don't post clarifying information as comments.) I think I've partly figured it out. It seems like it might need a bit more work. I ran ss -tn state listening on a host that runs an FTP server, and naturally the command showed that the machine was listening on port 21. So doesn't that mean that the egrep -v will filter out any remote hosts whose IP address includes "21" (including "210", "211", "212", ...)? Also, is the asort really necessary, or just window-dressing? – G-Man Mar 20 '15 at 2:38
I had to fix pretty much whole thing, the corrected script is above. – Dale Mar 20 '15 at 4:06
Ultimately, it would be a lot nicer if ss or netstat would just include this functionality in it. Do a ss --out to get a list of outgoing connections. – Dale Mar 20 '15 at 14:16
Nice, I like this answer. I'll try it out when I get back to improving security on my server. :D – trusktr Mar 31 '15 at 17:39
Looks like this could be used for UDP, too, but you just have to use different flags and states, of course. – Dale May 31 '15 at 4:16

tcpdump allows you to see all IP traffic flowing to/from a specific interface with the ability to filter based on certain criteria. tcpdump is typically installed on most *nix systems by default, if not there's usually a port somewhere to grab it for your specific distro.

share|improve this answer

netstat is a good option.Use the parameters as required.(see its man pages) For example

netstat -antup

Here it can monitor all(a) listening numeric (n) tcp (t) and udp (u) process (p).

You can also try the ss command . For reference use :

SS Linux TCP / UDP Network and Socket Information

share|improve this answer

If you run Solaris or a derivative, have a look at conntrack

share|improve this answer
Nice, that's also available on Arch Linux: archlinux.org/packages/community/i686/conntrack-tools -- Could you provide an example of how you'd use conntrack to see only connections started from local but not connections started from elsewhere? – trusktr Nov 24 '12 at 14:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.