Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using command nc -lu <port no.> to find on given port any data is receiving or not. I am getting data if there is transmission going on (but don't know from where!). Is there any way that should provide me the transmitters IP address??
wireshark and nmap are there, but I want a shorter way, if possible.
UPDATED: I think nc -luv is what I want, But at a time it is showing only one IP. I want to know if more than one system is transmitting through that port??

share|improve this question
    
netstat not available? –  Alex Apr 1 at 12:48
    
how to do with netstat? –  Tejas Apr 1 at 14:32
    
you could use strace against the pid of nc to trace system calls like connect –  rMistero Apr 1 at 23:57
add comment

5 Answers

up vote 2 down vote accepted
+50

I like the answers posted so far. Here are some other options:

Add the -v option to nc. This will show (only!) the first source address that a UDP packet is received from.

Also, netstat -nu seems to have some connection-ish state information for UDP conversations.

share|improve this answer
    
Gr8... Thanks but see updated Question. –  Tejas Apr 2 at 3:45
add comment

if the application uses a specific protocol, you can use a ngrep (for package inspection ) or a tcpdump (for port/host tracking). This is useful specially on a router or a proxy or DNS (if you can map the app to a hostname) to track the usage.

example for ssh:

ngrep SSH-2.0 

or access to site, via dns (DNS can be cached, but on a long run you can see who is using it)

ngrep bad.site.org port 53

or via ip connections:

tcpdump host bad.site.org 

Finally, you can use the nmap with the -A option, to help map the port to a specific protocol:

nmap -A 192.168.0.0/16 -p 8000-9000  2>/dev/null | grep "Interesting ports on\|open"

this will show the IP, open ports and the protocol/service if nmap manage to identify it

share|improve this answer
add comment

If the application uses a specific network port, nmap is your friend.

If not, you need to have some sort of monitoring or deployment software, or you need to run a script on each server to find what is installed and what is running. Example:

ssh servername 'ps -ef|grep appname|grep -v grep'

will show you if the app is actually running.

share|improve this answer
    
please go through updated Question. –  Tejas Apr 16 '13 at 11:06
    
please see updated answer :-) –  Jenny D Apr 16 '13 at 11:16
add comment

Run your nc command in background : nc -lu &

use lsof to see the network sockets used by nc.

lsof -i4 -n | grep ^nc

and then type :

watch -n 1 "lsof -i4 -n | grep ^nc"

Watch will re-run the command every second (it is not as accurate as wireshark) :

Every 1.0s: lsof -i4 -n | grep ^nc                                                                                        

nc        29033 user    3u  IPv4 4638215      0t0  UDP *:5007
nc        29469 user    3u  IPv4 4641772      0t0  UDP src_ip:46805->dest_ip:5007
share|improve this answer
add comment

I have another idea which I just used for a similar purpose:

Add a rule to your iptables :

-A INPUT -p tcp --dport <PORT_TO_MONITOR> -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

This will add a line to your system log for each new connection to that port.

You can also redirect this to a seperate log file, I believe.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.