0

I need to check if a server is accepting incoming traffic from a specified IP. Isn't enough to check only if a port is listening, because for example, even if I have port 22 open I don't know if it accept traffic from another server. I saw nmap and netstat but seems that they can't help me. Do you know a command to do this?

2 Answers 2

0

Netstat should indeed work for what you asked using the techniques FosseWay suggested, but one limitation is that its only going to show a point in time. An alternative if you want to check for traffic over a period of time would be to use WireShark. It might be overkill is some ways, since it has the ability to capture packets and even replay them, but its easy to use and has the ability to filter the traffic and only record it say from a specifc IP. this way you can see not just if traffic came from an IP but what the traffic was.

A good tutorial for installing and using WireShark can be found here. Feel free to post back if you have any questions on its function. https://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/

0

I use netstat to answer questions like this. I'm not sure why you say netstat can't help you, because it is certainly possible to determine whether or not your PC is currently receiving traffic from a specific IP using netstat.

Assuming you are on a current version of Windows: go to the Command Prompt, and type netstat -n to see all connections to/from your PC. Leave out the -n to see hostname (where your PC can determine it) instead of the IP address.

If the issue with using netstat to get what you want is that the amount of output is the issue (too many lines) then consider either copy/pasting the output to a good text editor, or using netstat in Windows PowerShell (hit the Windows key and type 'PowerShell', then select 'Windows PowerShell') in conjunction with Select-String to filter only for the IP you're interested in.

PS C:\> netstat -n | Select-String 10.11.15.41

TCP    192.168.1.1:22    10.11.15.41:62352       ESTABLISHED
TCP    192.168.1.1:22    10.11.15.41:63782       ESTABLISHED
TCP    192.168.1.1:22    10.11.15.41:60185       ESTABLISHED

If that's still showing too much information, you could use a second Select-String to filter only for lines including the string ":22":

netstat -n | Select-String 10.11.15.41 | Select-String :22

Similar results may be achieved on other operating systems (e.g. Linux, OSX) using netstat and grep.

If you need to set up monitoring, then this probably won't meet your needs, but for a quick answer to the question "Is X connecting to me?", netstat is both practical and useful. I use variations of this every day.

On the other hand, if you are asking "How can I tell if a particular host B is capable of making a connection to my host A on port 22?" - determining that routing is in place from B to A, and no firewall would block the connection attempt - then I don't think there's any way of knowing for sure from A. You'd have to access B, and conduct a test from B to A.

1
  • Even plain Windows CMD can do netstat | findstr or netstat | find (findstr does much of what Unix grep does but not all; find is closer to fgrep but that is enough here) Aug 24, 2017 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.