Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places.

How do I see only those outgoing connections?

EDIT: I'm new to these type of things. What I'm trying to do is just see if anything from my server is being sent out other than data for my web apps. For example, if someone visits my websites, then obviously my server will send out data to the client's browser. But suppose there's also code somewhere in my web app's framework that sends statistical data to somewhere else I'm not aware of. I'd like to see those places my server is sending data to, if any. It's probably not likely, but suppose you decide to use a php or nodejs framework that you didn't write: there's a small chance it may send some type of data somewhere. If so, that's what I'd like to see.

share|improve this question
add comment

5 Answers 5

Use netstat. For example

$ netstat -nputw
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
[...]
tcp        0      0 192.168.25.222:22       192.168.0.134:42903     ESTABLISHED 32663/sshd: gert [p

lists all UDP (u), TCP (t) and RAW (w) outgoing connections (not using l or a) in a numeric form (n, prevents possible long-running DNS queries) and includes the program (p) associated with that.

Consider adding the c option to get output being updated continuously.

share|improve this answer
    
Thanks. That's good info. Could you take a look at my updated question? –  trusktr Nov 24 '12 at 9:43
add comment

netstat is a good option.Use the parameters as required.(see its man pages) For example

netstat -antup

Here it can monitor all(a) listening numeric (n) tcp (t) and udp (u) process (p).

You can also try the ss command . For reference use :

SS Linux TCP / UDP Network and Socket Information

share|improve this answer
add comment

If you just want to just log every connection attempt, the easiest is probably iptables LOG target on Linux (or the equivalent firewall logging feature on your system).

If you need more information like duration of the connection and amount of data exchanged in both directions, then conntrackd (on Linux) is probably the best option.

However note that those two above only log the traffic that goes through netfilter, which is generally all the traffic but doesn't account traffic generated with IP stacks in user space (like virtual machines or anything using raw sockets) or bridged traffic.

For more general solutions, you can have a look at things like argus, bro-ids, sancp or ntop that log all sorts of information based on traffic they sniff on an interface.

share|improve this answer
add comment

If you run Solaris or a derivative, have a look at conntrack

share|improve this answer
    
Nice, that's also available on Arch Linux: archlinux.org/packages/community/i686/conntrack-tools -- Could you provide an example of how you'd use conntrack to see only connections started from local but not connections started from elsewhere? –  trusktr Nov 24 '12 at 14:19
add comment

tcpdump allows you to see all IP traffic flowing to/from a specific interface with the ability to filter based on certain criteria. tcpdump is typically installed on most *nix systems by default, if not there's usually a port somewhere to grab it for your specific distro.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.