Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I set up nc on some computers in my office. They're connecting to our server like so:

nc 192.168.1.2 3291 -e cmd

Does anyone know how to list incoming connection attempts rather than accept one? Not:

nc -l 192.168.1.2 3291

EDIT: Listing part solved, using tcpdump. Remaining part of question:

How to accept a connection in nc from a specific host only? i.e., 192.168.1.6, 192.168.1.7, and 192.168.1.8 are all asking to connect, and we only want to talk to 192.168.1.7. Is there any way to do this with nc?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

You want to see clients who are tyring to connect in realtime, right?

You can use tcpdump for this.

For example to watch what's happening on TCP port 3291 you can do tcpdump -i any tcp port 3291. Then you can watch in realtime all packets that arrive on this port.

share|improve this answer
    
Thanks, any way to single a client out and connect to it with nc? –  Megsi Feb 19 '13 at 3:13
    
you can single a client out using the pcap syntax: tcpdump -i any tcp port 3291 and host 1.2.3.4 –  mauro.stettler Feb 19 '13 at 3:15
    
but how do you want to connect to it? if you have an nc server running and listening there, you can connect back using nc –  mauro.stettler Feb 19 '13 at 3:16
    
btw. if you want to know more about the filters in tcpdump, this manpage is very helpful man 7 pcap-filter –  mauro.stettler Feb 19 '13 at 3:21
1  
preferably like nc -l 192.168.1.2 3291 --CLIENT-TO-CONNECT –  Megsi Feb 19 '13 at 3:23
show 1 more comment

Is this linux (both win and linux are tagged)?

You can have iptables both log and filter connections. This is a very poor example. Do more research into iptables (specifically logging) if you want to do this. Order matters. Persisting config varies between distros. On RHEL/CentOS iptables-save > /etc/sysconfig/iptables. Be careful.

iptables -N LOGREJECT
iptables -A LOGREJECT -j LOG --log-prefix="PORT3291: "
iptables -A LOGREJECT -j REJECT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -j LOGREJECT

In this example 127.0.0.1 and 192.168.1.100 are the only hosts permitted to connect. Everything else will be logged and rejected.

This should show in one of your logs somewhere. For me default log level will show in /var/log/messages and dmesg.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.