I am using command nc -lu <port no.> to find on given port any data is receiving or not. I am getting data if there is transmission going on (but don't know from where!). Is there any way that should provide me the transmitters IP address??
wireshark and nmap are there, but I want a shorter way, if possible.
UPDATED: I think nc -luv is what I want, But at a time it is showing only one IP. I want to know if more than one system is transmitting through that port??

  • netstat not available?
    – Alex
    Apr 1, 2014 at 12:48
  • how to do with netstat?
    – TPS
    Apr 1, 2014 at 14:32
  • you could use strace against the pid of nc to trace system calls like connect
    – UnX
    Apr 1, 2014 at 23:57

5 Answers 5


if the application uses a specific protocol, you can use a ngrep (for package inspection ) or a tcpdump (for port/host tracking). This is useful specially on a router or a proxy or DNS (if you can map the app to a hostname) to track the usage.

example for ssh:

ngrep SSH-2.0 

or access to site, via dns (DNS can be cached, but on a long run you can see who is using it)

ngrep bad.site.org port 53

or via ip connections:

tcpdump host bad.site.org 

Finally, you can use the nmap with the -A option, to help map the port to a specific protocol:

nmap -A -p 8000-9000  2>/dev/null | grep "Interesting ports on\|open"

this will show the IP, open ports and the protocol/service if nmap manage to identify it


If the application uses a specific network port, nmap is your friend.

If not, you need to have some sort of monitoring or deployment software, or you need to run a script on each server to find what is installed and what is running. Example:

ssh servername 'ps -ef|grep appname|grep -v grep'

will show you if the app is actually running.

  • please go through updated Question.
    – TPS
    Apr 16, 2013 at 11:06
  • please see updated answer :-)
    – Jenny D
    Apr 16, 2013 at 11:16

I like the answers posted so far. Here are some other options:

Add the -v option to nc. This will show (only!) the first source address that a UDP packet is received from.

Also, netstat -nu seems to have some connection-ish state information for UDP conversations.

  • Gr8... Thanks but see updated Question.
    – TPS
    Apr 2, 2014 at 3:45

Run your nc command in background : nc -lu &

use lsof to see the network sockets used by nc.

lsof -i4 -n | grep ^nc

and then type :

watch -n 1 "lsof -i4 -n | grep ^nc"

Watch will re-run the command every second (it is not as accurate as wireshark) :

Every 1.0s: lsof -i4 -n | grep ^nc                                                                                        

nc        29033 user    3u  IPv4 4638215      0t0  UDP *:5007
nc        29469 user    3u  IPv4 4641772      0t0  UDP src_ip:46805->dest_ip:5007

I have another idea which I just used for a similar purpose:

Add a rule to your iptables :

-A INPUT -p tcp --dport <PORT_TO_MONITOR> -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7

This will add a line to your system log for each new connection to that port.

You can also redirect this to a seperate log file, I believe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.