I can easily log new tcp connections with iptables like this:

iptables -A INPUT -p tcp --dport XYZ -m state --state NEW -j LOG

Is there a way to log when a connection is closed?

  • The command didn't work for me until I changed -dport to --dport – Jacob Gabrielson May 7 '19 at 15:38
  • Thx, updated answer. – gogators May 7 '19 at 17:08

There might be something better, but the tcp protocol ends connections with the FIN or RST packets. You could match on these.

iptables -I INPUT -p tcp --dport XYZ --tcp-flags FIN FIN -j LOG
iptables -I INPUT -p tcp --dport XYZ --tcp-flags RST RST -j LOG

The FIN is repeated as --tcp-flags takes 2 arguments, a mask of what flags to look at, and what combination to accept.

|improve this answer|||||
  • Seems to work. Thanks. conntrack is also useful for this. – gogators Oct 19 '16 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.