I am using command
nc -lu <port no.> to find on given port any data is receiving or not. I am getting data if there is transmission going on (but don't know from where!). Is there any way that should provide me the transmitters IP address??
nmap are there, but I want a shorter way, if possible.
UPDATED: I think
nc -luv is what I want, But at a time it is showing only one IP. I want to know if more than one system is transmitting through that port??
I am using command
I like the answers posted so far. Here are some other options:
-v option to nc. This will show (only!) the first source address that a UDP packet is received from.
netstat -nu seems to have some connection-ish state information for UDP conversations.
if the application uses a specific protocol, you can use a ngrep (for package inspection ) or a tcpdump (for port/host tracking). This is useful specially on a router or a proxy or DNS (if you can map the app to a hostname) to track the usage.
example for ssh:
or access to site, via dns (DNS can be cached, but on a long run you can see who is using it)
ngrep bad.site.org port 53
or via ip connections:
tcpdump host bad.site.org
Finally, you can use the nmap with the -A option, to help map the port to a specific protocol:
nmap -A 192.168.0.0/16 -p 8000-9000 2>/dev/null | grep "Interesting ports on\|open"
this will show the IP, open ports and the protocol/service if nmap manage to identify it
If the application uses a specific network port,
nmap is your friend.
If not, you need to have some sort of monitoring or deployment software, or you need to run a script on each server to find what is installed and what is running. Example:
ssh servername 'ps -ef|grep appname|grep -v grep'
will show you if the app is actually running.
Run your nc command in background : nc -lu &
use lsof to see the network sockets used by nc.
lsof -i4 -n | grep ^nc
and then type :
watch -n 1 "lsof -i4 -n | grep ^nc"
Watch will re-run the command every second (it is not as accurate as wireshark) :
Every 1.0s: lsof -i4 -n | grep ^nc nc 29033 user 3u IPv4 4638215 0t0 UDP *:5007 nc 29469 user 3u IPv4 4641772 0t0 UDP src_ip:46805->dest_ip:5007
I have another idea which I just used for a similar purpose:
Add a rule to your iptables :
-A INPUT -p tcp --dport <PORT_TO_MONITOR> -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7
This will add a line to your system log for each new connection to that port.
You can also redirect this to a seperate log file, I believe.