Difference between revisions of "Network Connection Monitoring in Linux"

From Free Knowledge Base- The DUCK Project: information for everyone
Jump to: navigation, search
m
m
Line 20: Line 20:
 
continuously updated
 
continuously updated
 
  netstat -nputwc
 
  netstat -nputwc
 +
 +
show established connections on port 80, which is commonly used for HTTP traffic.
 +
netstat -anp | grep ESTABLISHED | grep :80
  
 
=== tcpdump ===
 
=== tcpdump ===
 
   
 
   
 
  tcpdump -X -i eth0
 
  tcpdump -X -i eth0
 +
 +
Say we want to capture packets from a specific host for analysis:
 +
sudo tcpdump -i <interface> host googleusercontent.com
  
 
=== lsof ===
 
=== lsof ===
Line 29: Line 35:
 
View established connections and associated programs type TCP only
 
View established connections and associated programs type TCP only
 
  sudo lsof -nP -iTCP -sTCP:ESTABLISHED
 
  sudo lsof -nP -iTCP -sTCP:ESTABLISHED
 +
 +
List open files and can help identify the processes associated with network connections; example will show processes that are using port 80 for network connections.
 +
sudo lsof -i :80
  
 
=== ethtool ===
 
=== ethtool ===
Line 38: Line 47:
 
=== iftop ===
 
=== iftop ===
  
iftop is a real-time console-based network bandwidth monitoring tool.
+
iftop is a real-time console-based network bandwidth monitoring tool.
 
  sudo iftop
 
  sudo iftop
 +
iftop primarily displays a real-time, interactive view of network bandwidth usage. While it shows the hosts that your system is communicating with, it doesn't directly provide information about the specific software or process associated with each connection.

Revision as of 17:05, 11 January 2024

ss

ss             list out all connections.
ss -t          tcp only.  
ss -u          udp only.
ss -x          unix only.
ss -a -A udp   report both "CONNECTED" and "LISTENING" sockets udp
ss -nt         tcp with hostnames not resolved.
ss -ltn        listening sockets only, tcp with hostnames not resolved.
ss -pnt        tcp with hostnames not resolved, associated process id's using connection. <- very useful
ss -s          summary statistics

netstat

netstat -natp  show active Internet connections
netstat -tupn

View established connections and associated programs

sudo netstat -atupen | grep ESTABLISHED
netstat -nputw

continuously updated

netstat -nputwc

show established connections on port 80, which is commonly used for HTTP traffic.

netstat -anp | grep ESTABLISHED | grep :80

tcpdump

tcpdump -X -i eth0

Say we want to capture packets from a specific host for analysis:

sudo tcpdump -i <interface> host googleusercontent.com

lsof

View established connections and associated programs type TCP only

sudo lsof -nP -iTCP -sTCP:ESTABLISHED

List open files and can help identify the processes associated with network connections; example will show processes that are using port 80 for network connections.

sudo lsof -i :80

ethtool

To get information about your Ethernet interface, you can use:

ethtool eth0

Replace eth0 with your actual interface name.

iftop

iftop is a real-time console-based network bandwidth monitoring tool.

sudo iftop

iftop primarily displays a real-time, interactive view of network bandwidth usage. While it shows the hosts that your system is communicating with, it doesn't directly provide information about the specific software or process associated with each connection.