find which system is transmitting through a particular port

Question

I am using command nc -lu <port no.> to find on given port any data is receiving or not. I am getting data if there is transmission going on (but don't know from where!). Is there any way that should provide me the transmitters IP address??
wireshark and nmap are there, but I want a shorter way, if possible.
UPDATED: I think nc -luv is what I want, But at a time it is showing only one IP. I want to know if more than one system is transmitting through that port??

Answer 1

if the application uses a specific protocol, you can use a ngrep (for package inspection ) or a tcpdump (for port/host tracking). This is useful specially on a router or a proxy or DNS (if you can map the app to a hostname) to track the usage.

example for ssh:

ngrep SSH-2.0 

or access to site, via dns (DNS can be cached, but on a long run you can see who is using it)

ngrep bad.site.org port 53

or via ip connections:

tcpdump host bad.site.org 

Finally, you can use the nmap with the -A option, to help map the port to a specific protocol:

nmap -A 192.168.0.0/16 -p 8000-9000  2>/dev/null | grep "Interesting ports on\|open"

this will show the IP, open ports and the protocol/service if nmap manage to identify it

Answer 2

If the application uses a specific network port, nmap is your friend.

If not, you need to have some sort of monitoring or deployment software, or you need to run a script on each server to find what is installed and what is running. Example:

ssh servername 'ps -ef|grep appname|grep -v grep'

will show you if the app is actually running.

Answer 3

I like the answers posted so far. Here are some other options:

Add the -v option to nc. This will show (only!) the first source address that a UDP packet is received from.

Also, netstat -nu seems to have some connection-ish state information for UDP conversations.

Answer 4

Run your nc command in background : nc -lu &

use lsof to see the network sockets used by nc.

lsof -i4 -n | grep ^nc

and then type :

watch -n 1 "lsof -i4 -n | grep ^nc"

Watch will re-run the command every second (it is not as accurate as wireshark) :

Every 1.0s: lsof -i4 -n | grep ^nc                                                                                        

nc        29033 user    3u  IPv4 4638215      0t0  UDP *:5007
nc        29469 user    3u  IPv4 4641772      0t0  UDP src_ip:46805->dest_ip:5007

Answer 5

I have another idea which I just used for a similar purpose:

Add a rule to your iptables :

-A INPUT -p tcp --dport <PORT_TO_MONITOR> -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

This will add a line to your system log for each new connection to that port.

You can also redirect this to a seperate log file, I believe.