I am using command nc -lu <port no.>
to find on given port any data is receiving or not. I am getting data if there is transmission going on (but don't know from where!). Is there any way that should provide me the transmitters IP address??
wireshark
and nmap
are there, but I want a shorter way, if possible.
UPDATED: I think nc -luv
is what I want, But at a time it is showing only one IP. I want to know if more than one system is transmitting through that port??
5 Answers
if the application uses a specific protocol, you can use a ngrep (for package inspection ) or a tcpdump (for port/host tracking). This is useful specially on a router or a proxy or DNS (if you can map the app to a hostname) to track the usage.
example for ssh:
ngrep SSH-2.0
or access to site, via dns (DNS can be cached, but on a long run you can see who is using it)
ngrep bad.site.org port 53
or via ip connections:
tcpdump host bad.site.org
Finally, you can use the nmap with the -A option, to help map the port to a specific protocol:
nmap -A 192.168.0.0/16 -p 8000-9000 2>/dev/null | grep "Interesting ports on\|open"
this will show the IP, open ports and the protocol/service if nmap manage to identify it
If the application uses a specific network port, nmap
is your friend.
If not, you need to have some sort of monitoring or deployment software, or you need to run a script on each server to find what is installed and what is running. Example:
ssh servername 'ps -ef|grep appname|grep -v grep'
will show you if the app is actually running.
I like the answers posted so far. Here are some other options:
Add the -v
option to nc. This will show (only!) the first source address that a UDP packet is received from.
Also, netstat -nu
seems to have some connection-ish state information for UDP conversations.
Run your nc command in background : nc -lu &
use lsof to see the network sockets used by nc.
lsof -i4 -n | grep ^nc
and then type :
watch -n 1 "lsof -i4 -n | grep ^nc"
Watch will re-run the command every second (it is not as accurate as wireshark) :
Every 1.0s: lsof -i4 -n | grep ^nc
nc 29033 user 3u IPv4 4638215 0t0 UDP *:5007
nc 29469 user 3u IPv4 4641772 0t0 UDP src_ip:46805->dest_ip:5007
I have another idea which I just used for a similar purpose:
Add a rule to your iptables :
-A INPUT -p tcp --dport <PORT_TO_MONITOR> -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7
This will add a line to your system log for each new connection to that port.
You can also redirect this to a seperate log file, I believe.
netstat
not available?netstat
?