0

I have been asked by a customer to provide a list of all URL's that my company's linux server connects to in order to complete a software update including individual TCP,UDP ports that these connections use. This is so that the customer can create a custom connection for our server to the internet.

I have tried using netstat to get some kind of log but cannot get it to show full URL's, it will only show IP addresses.

This is the command i have used so far.

    netstat -putwc 

Any help would be greatly appreciated.

Thanks.

All of the URL’s that the VOCOVO unit needs to connect. 2. TCP, UDP ports that these connections will use. 3. Bandwidth required for each transaction.

1

What kind of software are you trying to update? From what information you provided, it probably only uses HTTP(S) (TCP ports 80 or 443), but you'll need tools that know about HTTP(S) to be of much use.

HTTP URLs operate at the application layer (OSI layer 7): netstat operates at the network/transport layers (OSI layers 3/4), so you won't be able to get the information from it because it's not designed to do that. It's like trying to get the name of the people who live in a house based only from a street address.

Can you use any other tools, like Wireshark or a proxy server? If you had a proxy server, you could log the requests through that (and get a rough idea of the bandwidth too!) If your program uses more exotic protocols, Wireshark may be able to help.

1

I am giving an answer, though not exactly what you are asking.

For necessary ports for connections to install packages/do security updates are usually 80/TCP and 443/TCP; the addresses depend on the repos you are using.

If using a proxy, however, instead of monitoring/selecting addresses, it would be wiser to whitelist in the proxy APT or YUM connections (e.g. per app).

As for monitoring, you can use tcpdump while doing security updates and installing packages as in:

sudo tcpdump port 80 or port 443

However, beware that depending on the name of repos you are using, some repo names might translate to more than one IP address.

As for network usage, it is not significant if only a single system, however it varies in whatever updates are installed. I would monitor it over time with SNMP and cacti. You can also try to use iftop, but then again such measures will be worthless.

Getting to the point, the traffic data should be either estimated/guessed or measured over months.

  • 1
    Filtering on tcp syn packets could also be helpful, in this case, for reducing the output: sudo tcpdump ... 'tcp[tcpflags] == 2 and (port 80 or port 443)' – user234931 Mar 15 '18 at 0:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.