7

I administer an Ubunu Server exposed to the internet and have the need to monitor and keep track of all the network activity in a manner that allows me to analyze it afterwards.

I already tried some tools, such as tshark or tcpdump, which give me too much detail, vnstat, which does not give me the detail I want (It shows only the bandwidth), and tcptrack, which is OK as a real time monitoring tool but gives me no logging option for further analysis.

What I have in mind is something between tcptrack and vnstat:

A daemon which logs every connection and, when needed, it provides me with a comprehensive report showing IPs, ports and timestamps of every established connection, and every connection attempt (so, it should also show the SYN packets of the connections dropped by iptables). Ideally (this is just a bonus point :), it would store information into some sql database, such as mysql or postgresql, which would allow to execute arbitrary select statements in order to obtain custom reports (for example, monitor all the activity coming from a single IP, or extract a list of all IPs using a specific service).

I must say that I already tried combining some tools, like logging with tcpdump and then showing the results using tcptrack, but I it didn't work as expected.

So, is there any tool close to this "idea"?

Improve this question
3
  • ntop or blanket log rules in iptables. Syslog can be configured to insert into databases.
    – jordanm
    Commented Oct 26, 2013 at 16:24
  • Have you looked into the LOG jump point in iptables? For example iptables -I INPUT -j LOG will syslog all inbound packets. You can use the normal criteria for limiting the packets that match the logging rule (for example only new TCP connections, etc). It won't be a report (hence a comment) but it will record this information.
    – Bratchley
    Commented Oct 26, 2013 at 16:24
  • I had a look at ntop and it looks as a good tool. However, few minutes after a connection is dropped it disappears from the list. Is there a way to get a historical report from it?
    – Carles Sala
    Commented Oct 26, 2013 at 18:11

1 Answer 1

Reset to default
3

I think the easiest method to achieve what you want here will be the use of iptables along with logging to either the LOG or ULOG targets.

This will leave you with the following type of log information:

Aug 13 14:42:07 srv1 IN=eth0 OUT= MAC=00:0c:29:8c:2b:6c:00:d0:02:eb:e8:0a:08:00 SRC=75.125.70.194 DST=XXX.XXX.XXX.XXX LEN=40 TOS=00 PREC=0×00 TTL=54 ID=9566 PROTO=TCP SPT=57144 DPT=445 SEQ=2770468863 ACK=0 WINDOW=512 SYN URGP=0

Aug 13 14:45:29 srv1 IN=eth0 OUT= MAC=00:0c:29:8c:2b:6c:00:d0:02:eb:e8:0a:08:00 SRC=75.125.70.194 DST=XXX.XXX.XXX.XXX LEN=40 TOS=00 PREC=0×00 TTL=55 ID=13702 PROTO=TCP SPT=58528 DPT=445 SEQ=1217789951 ACK=0 WINDOW=512 SYN URGP=0

You'll then be able to use standard tools such as awk or grep to pull data from this when you want to see what's going on on this system.

2 rules such as these should log any "NEW" connections that are either incoming or outgoing. These will prefix the rules so that they're esaier to spot:

iptables -I INPUT -m state --state NEW -j LOG --log-prefix "New Connection: "
iptables -I OUTPUT -m state --state NEW -j LOG --log-prefix "New Connection: "

Resulting in log entries like this:

[ 2134.566659] New Connection: IN= OUT=wlan0 SRC=192.168.178.229 DST=192.168.178.21 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65094 DF PROTO=UDP SPT=55717 DPT=53 LEN=40

References

Improve this answer
2
  • Yes, it looks like iptables logging is what I should be thinking about. However, in your example: what about the connection attempts blocked by iptables? Would they be included into this --state NEW category or should I create another rule specifically for them?
    – Carles Sala
    Commented Oct 27, 2013 at 13:12
  • @CarlesSala - --state NEW includes any packets related to a connection that is being seen for the first time.
    – slm ♦
    Commented Oct 27, 2013 at 14:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .