Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've searched quite extensively for this, but cannot seem to come up with a working example.

My objective is to monitor TCP traffic on a specific port to see incoming connections and write them to a text file. The catch is I also need a timestamp on each row to show exactly when the client connected down to the second.

I've already exhausted netstat, nmap, and tcptrack, but none support timestamp.

I was thinking a linux shell script might work if I monitored a specific local port and wrote text to a file when a connection is made then just concatenate the date on each line.

I was playing with this:

netstat -ano|grep 443|grep ESTABLISHED

as well as this:

tcptrack -i eth0 port 443

but neither suit my needs as I need the time the connection comes in at.

If you have any suggestions or could point me in the right direction it would be greatly appreciated.

Thanks. :)

share|improve this question

migrated from stackoverflow.com Jun 7 '13 at 16:35

This question came from our site for professional and enthusiast programmers.

add comment

4 Answers 4

up vote 1 down vote accepted
tcpdump port 443 and '(tcp-syn|tcp-ack)!=0'

or only tcp-syn, or only tcp-ack (my guess would be that one), depending on what you need.

share|improve this answer
    
Thanks that's exactly what I'm looking for. –  tajonny07 Jun 7 '13 at 16:14
    
Instead of showing the hostname for each connection, is there a way to override it with the IP? –  tajonny07 Jun 7 '13 at 16:20
    
Yep, add -n after tcpdump (man tcpdump: -n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.) –  Wrikken Jun 8 '13 at 0:33
add comment

Micro-Second Resolution

By default, the tcpdump utility will report time with micro-second resolution. For example:

$ sudo tcpdump -i any port 443

will show output similar to the following:

12:08:14.028945 IP localhost.33255 > localhost.https: Flags [S], seq 1828376761, win 43690, options [mss 65495,sackOK,TS val 108010971 ecr 0,nop,wscale 7], length 0
12:08:14.028959 IP localhost.https > localhost.33255: Flags [R.], seq 0, ack 1828376762, win 0, length 0

See tcpdump(8) for a full list of tcpdump options, and pcap-filter(7) for the complete syntax of the filters you can use.

share|improve this answer
add comment

You can use tcpdump or Wireshark.

share|improve this answer
add comment

443 is encrypted traffic - so difficult to make heads or tails of traffic on this port anyhow:

you can do

yum install ngrep or apt-get install ngrep

then run

ngrep -W byline -d any port 443 -q
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.