Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I administer an Ubunu Server exposed to the internet and have the need to monitor and keep track of all the network activity in a manner that allows me to analyze it afterwards.

I already tried some tools, such as tshark or tcpdump, which give me too much detail, vnstat, which does not give me the detail I want (It shows only the bandwidth), and tcptrack, which is OK as a real time monitoring tool but gives me no logging option for further analysis.

What I have in mind is something between tcptrack and vnstat:

A daemon which logs every connection and, when needed, it provides me with a comprehensive report showing IPs, ports and timestamps of every established connection, and every connection attempt (so, it should also show the SYN packets of the connections dropped by iptables). Ideally (this is just a bonus point :), it would store information into some sql database, such as mysql or postgresql, which would allow to execute arbitrary select statements in order to obtain custom reports (for example, monitor all the activity coming from a single IP, or extract a list of all IPs using a specific service).

I must say that I already tried combining some tools, like logging with tcpdump and then showing the results using tcptrack, but I it didn't work as expected.

So, is there any tool close to this "idea"?

share|improve this question
    
ntop or blanket log rules in iptables. Syslog can be configured to insert into databases. –  jordanm Oct 26 '13 at 16:24
    
Have you looked into the LOG jump point in iptables? For example iptables -I INPUT -j LOG will syslog all inbound packets. You can use the normal criteria for limiting the packets that match the logging rule (for example only new TCP connections, etc). It won't be a report (hence a comment) but it will record this information. –  Joel Davis Oct 26 '13 at 16:24
    
I had a look at ntop and it looks as a good tool. However, few minutes after a connection is dropped it disappears from the list. Is there a way to get a historical report from it? –  Carles Sala Oct 26 '13 at 18:11

1 Answer 1

I think the easiest method to achieve what you want here will be the use of iptables along with logging to either the LOG or ULOG targets.

This will leave you with the following type of log information:

Aug 13 14:42:07 srv1 IN=eth0 OUT= MAC=00:0c:29:8c:2b:6c:00:d0:02:eb:e8:0a:08:00 SRC=75.125.70.194 DST=XXX.XXX.XXX.XXX LEN=40 TOS=00 PREC=0×00 TTL=54 ID=9566 PROTO=TCP SPT=57144 DPT=445 SEQ=2770468863 ACK=0 WINDOW=512 SYN URGP=0

Aug 13 14:45:29 srv1 IN=eth0 OUT= MAC=00:0c:29:8c:2b:6c:00:d0:02:eb:e8:0a:08:00 SRC=75.125.70.194 DST=XXX.XXX.XXX.XXX LEN=40 TOS=00 PREC=0×00 TTL=55 ID=13702 PROTO=TCP SPT=58528 DPT=445 SEQ=1217789951 ACK=0 WINDOW=512 SYN URGP=0

You'll then be able to use standard tools such as awk or grep to pull data from this when you want to see what's going on on this system.

2 rules such as these should log any "NEW" connections that are either incoming or outgoing. These will prefix the rules so that they're esaier to spot:

iptables -I INPUT -m state --state NEW -j LOG --log-prefix "New Connection: "
iptables -I OUTPUT -m state --state NEW -j LOG --log-prefix "New Connection: "

Resulting in log entries like this:

[ 2134.566659] New Connection: IN= OUT=wlan0 SRC=192.168.178.229 DST=192.168.178.21 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65094 DF PROTO=UDP SPT=55717 DPT=53 LEN=40

References

share|improve this answer
    
Yes, it looks like iptables logging is what I should be thinking about. However, in your example: what about the connection attempts blocked by iptables? Would they be included into this --state NEW category or should I create another rule specifically for them? –  Carles Sala Oct 27 '13 at 13:12
    
@CarlesSala - --state NEW includes any packets related to a connection that is being seen for the first time. –  slm Oct 27 '13 at 14:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.