2

I set up nc on some computers in my office. They're connecting to our server like so:

nc 192.168.1.2 3291 -e cmd

Does anyone know how to list incoming connection attempts rather than accept one? Not:

nc -l 192.168.1.2 3291

EDIT: Listing part solved, using tcpdump. Remaining part of question:

How to accept a connection in nc from a specific host only? i.e., 192.168.1.6, 192.168.1.7, and 192.168.1.8 are all asking to connect, and we only want to talk to 192.168.1.7. Is there any way to do this with nc?

2 Answers 2

5

You want to see clients who are tyring to connect in realtime, right?

You can use tcpdump for this.

For example to watch what's happening on TCP port 3291 you can do tcpdump -i any tcp port 3291. Then you can watch in realtime all packets that arrive on this port.

6
  • Thanks, any way to single a client out and connect to it with nc?
    – Megsi
    Feb 19, 2013 at 3:13
  • you can single a client out using the pcap syntax: tcpdump -i any tcp port 3291 and host 1.2.3.4
    – replay
    Feb 19, 2013 at 3:15
  • but how do you want to connect to it? if you have an nc server running and listening there, you can connect back using nc
    – replay
    Feb 19, 2013 at 3:16
  • btw. if you want to know more about the filters in tcpdump, this manpage is very helpful man 7 pcap-filter
    – replay
    Feb 19, 2013 at 3:21
  • 1
    preferably like nc -l 192.168.1.2 3291 --CLIENT-TO-CONNECT
    – Megsi
    Feb 19, 2013 at 3:23
0

Is this linux (both win and linux are tagged)?

You can have iptables both log and filter connections. This is a very poor example. Do more research into iptables (specifically logging) if you want to do this. Order matters. Persisting config varies between distros. On RHEL/CentOS iptables-save > /etc/sysconfig/iptables. Be careful.

iptables -N LOGREJECT
iptables -A LOGREJECT -j LOG --log-prefix="PORT3291: "
iptables -A LOGREJECT -j REJECT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 3291 -j LOGREJECT

In this example 127.0.0.1 and 192.168.1.100 are the only hosts permitted to connect. Everything else will be logged and rejected.

This should show in one of your logs somewhere. For me default log level will show in /var/log/messages and dmesg.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .