Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set up nc on some computers in my office. They're connecting to our server like so:

nc 3291 -e cmd

Does anyone know how to list incoming connection attempts rather than accept one? Not:

nc -l 3291

EDIT: Listing part solved, using tcpdump. Remaining part of question:

How to accept a connection in nc from a specific host only? i.e.,,, and are all asking to connect, and we only want to talk to Is there any way to do this with nc?

share|improve this question
up vote 1 down vote accepted

You want to see clients who are tyring to connect in realtime, right?

You can use tcpdump for this.

For example to watch what's happening on TCP port 3291 you can do tcpdump -i any tcp port 3291. Then you can watch in realtime all packets that arrive on this port.

share|improve this answer
Thanks, any way to single a client out and connect to it with nc? – Megsi Feb 19 '13 at 3:13
you can single a client out using the pcap syntax: tcpdump -i any tcp port 3291 and host – mauro.stettler Feb 19 '13 at 3:15
but how do you want to connect to it? if you have an nc server running and listening there, you can connect back using nc – mauro.stettler Feb 19 '13 at 3:16
btw. if you want to know more about the filters in tcpdump, this manpage is very helpful man 7 pcap-filter – mauro.stettler Feb 19 '13 at 3:21
preferably like nc -l 3291 --CLIENT-TO-CONNECT – Megsi Feb 19 '13 at 3:23

Is this linux (both win and linux are tagged)?

You can have iptables both log and filter connections. This is a very poor example. Do more research into iptables (specifically logging) if you want to do this. Order matters. Persisting config varies between distros. On RHEL/CentOS iptables-save > /etc/sysconfig/iptables. Be careful.

iptables -N LOGREJECT
iptables -A LOGREJECT -j LOG --log-prefix="PORT3291: "
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -j LOGREJECT

In this example and are the only hosts permitted to connect. Everything else will be logged and rejected.

This should show in one of your logs somewhere. For me default log level will show in /var/log/messages and dmesg.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .