So, you want to spy on the other users of the server?
Without root privileges, you cannot do that effectively.
The closest you can get is running the
netstat -an command repeatedly and parsing the output. If the system is using containers or some other isolation technology, the
netstat command might only show the connections for your container. On a security-hardened server, the
netstat command might even be restricted for administrators only.
With root privileges, you could, for example, set up an
iptables logging rule that would cause a log message to be created for all new incoming connections. And then you could configure the syslog daemon to write those messages to a specific file, or to send them over the network to some other system. If you send the log messages over the network, then you would then have to set up a receiver for the log messages in the system you send the messages to.
On a server that might have multiple users, there may be a lot of incoming connections happening simultaneously. Some of those would actually be internal connections between processes within the same server; in particular, Java processes tend to use a lot of "network" connections to communicate between different processes within the same server. In such a situation, the information you are looking for would be hidden among an overwhelming amount of messages about connections that are unimportant to you. So it might be to your advantage to be more specific in your information requests.
If I may ask, what is the reason you need the information on incoming connections for? It might be possible to produce the information to suit your specific need in some other way.
For example, if you need to map the server's network connections for some sort of handover of the administration responsibility, then you could first use
netstat -na -A inet and
netstat -na -A inet6 to identify all TCP/UDP ports that are capable of receiving incoming connections. For TCP ports, you'd simply look for ports in
LISTEN state; for UDP ports you would have to check all listed ports to determine whether they're used for incoming or outgoing packets.
Once you have a list of services actually active on the system, you can then exclude the things you're not interested in; for example, if the server is being handed over from one hosting provider to another, the ports used by the server monitoring infrastructure of the old provider are not going to be very interesting, as the old provider is likely to remove their monitoring utilities before the actual handover, and the new provider is likely to install their own monitoring tools.
The next step could be to review the logs of the interesting services: if you can access the logs and they have the information you need, that might be the best option. If you don't have the necessary access, a request to read access to the old logs of a specific service might be more well received by the server administrator than an all-encompassing request to monitor all incoming connections.
With a bit of scripting, you could search the logs for messages indicating incoming connections (
grep), pick out the connection source information (with
awk or whatever tool you prefer), then remove duplicates (with
sort followed by
uniq). By processing any existing logs like this, you might have a better chance of catching connections that happen only rarely (e.g. once a week or month) than by just monitoring all incoming connections for a few days.