0

I have a server with Linux Red-hat Enterprise Edition 5.4 installed.

and a client/server application that permits connection at the port 6000, but it doesn't offer connections log.

I want to know witch IP address connected to the server in the last week.

How to do that??

3
  • If it isn't logged, then you can't from the machine. Is there a firewall in the path?
    – Paul
    May 19, 2013 at 12:10
  • You could make your own log by running tcpdump on the server and capture connections to port 6000
    – parkydr
    May 19, 2013 at 12:18
  • The servers firewall (iptables) is disabled. I created a rule iptables -I INPUT -p tcp --dport 6000 -j LOG and it show connection on the port since it was created. I want to show old connections
    – Ould Abba
    May 19, 2013 at 12:29

1 Answer 1

0

Without any further information on the application, e. g. is it web server-based, native, etc., it is hard to tell.

From the operating system perspective, one possibility is using tcpdump and filtering on that specific port. You could generate your own log files that way and process them as needed.

Another solution would be to use iptables, but this will most certainly slow down your system performance.

From the network perspective, you could use netflow (if your network devices support this) and grab the connection data.

But all of the possibilities listed are NOT retrospective. For the PAST time, there would not be a chance.

Maybe your network guys can help? They might have connection or traffic logs on their devices.

1
  • I know how to use iptables, but as you said, its gonna slow down my system. What about tcpdump and how to use it, any hints??
    – Ould Abba
    May 29, 2013 at 10:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .