Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a server with Linux Red-hat Enterprise Edition 5.4 installed.

and a client/server application that permits connection at the port 6000, but it doesn't offer connections log.

I want to know witch IP address connected to the server in the last week.

How to do that??

share|improve this question
    
If it isn't logged, then you can't from the machine. Is there a firewall in the path? –  Paul May 19 '13 at 12:10
    
You could make your own log by running tcpdump on the server and capture connections to port 6000 –  parkydr May 19 '13 at 12:18
    
The servers firewall (iptables) is disabled. I created a rule iptables -I INPUT -p tcp --dport 6000 -j LOG and it show connection on the port since it was created. I want to show old connections –  Ould Abba May 19 '13 at 12:29

1 Answer 1

Without any further information on the application, e. g. is it web server-based, native, etc., it is hard to tell.

From the operating system perspective, one possibility is using tcpdump and filtering on that specific port. You could generate your own log files that way and process them as needed.

Another solution would be to use iptables, but this will most certainly slow down your system performance.

From the network perspective, you could use netflow (if your network devices support this) and grab the connection data.

But all of the possibilities listed are NOT retrospective. For the PAST time, there would not be a chance.

Maybe your network guys can help? They might have connection or traffic logs on their devices.

share|improve this answer
    
I know how to use iptables, but as you said, its gonna slow down my system. What about tcpdump and how to use it, any hints?? –  Ould Abba May 29 '13 at 10:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.