Difference between revisions of "Network Connection Monitoring in Linux"
m |
m |
||
| Line 20: | Line 20: | ||
continuously updated | continuously updated | ||
netstat -nputwc | netstat -nputwc | ||
| + | |||
| + | show established connections on port 80, which is commonly used for HTTP traffic. | ||
| + | netstat -anp | grep ESTABLISHED | grep :80 | ||
=== tcpdump === | === tcpdump === | ||
tcpdump -X -i eth0 | tcpdump -X -i eth0 | ||
| + | |||
| + | Say we want to capture packets from a specific host for analysis: | ||
| + | sudo tcpdump -i <interface> host googleusercontent.com | ||
=== lsof === | === lsof === | ||
| Line 29: | Line 35: | ||
View established connections and associated programs type TCP only | View established connections and associated programs type TCP only | ||
sudo lsof -nP -iTCP -sTCP:ESTABLISHED | sudo lsof -nP -iTCP -sTCP:ESTABLISHED | ||
| + | |||
| + | List open files and can help identify the processes associated with network connections; example will show processes that are using port 80 for network connections. | ||
| + | sudo lsof -i :80 | ||
=== ethtool === | === ethtool === | ||
| Line 38: | Line 47: | ||
=== iftop === | === iftop === | ||
| − | iftop is a real-time console-based network bandwidth monitoring tool. | + | iftop is a real-time console-based network bandwidth monitoring tool. |
sudo iftop | sudo iftop | ||
| + | iftop primarily displays a real-time, interactive view of network bandwidth usage. While it shows the hosts that your system is communicating with, it doesn't directly provide information about the specific software or process associated with each connection. | ||
Revision as of 16:05, 11 January 2024
ss
ss list out all connections. ss -t tcp only. ss -u udp only. ss -x unix only. ss -a -A udp report both "CONNECTED" and "LISTENING" sockets udp ss -nt tcp with hostnames not resolved. ss -ltn listening sockets only, tcp with hostnames not resolved. ss -pnt tcp with hostnames not resolved, associated process id's using connection. <- very useful ss -s summary statistics
netstat
netstat -natp show active Internet connections netstat -tupn
View established connections and associated programs
sudo netstat -atupen | grep ESTABLISHED netstat -nputw
continuously updated
netstat -nputwc
show established connections on port 80, which is commonly used for HTTP traffic.
netstat -anp | grep ESTABLISHED | grep :80
tcpdump
tcpdump -X -i eth0
Say we want to capture packets from a specific host for analysis:
sudo tcpdump -i <interface> host googleusercontent.com
lsof
View established connections and associated programs type TCP only
sudo lsof -nP -iTCP -sTCP:ESTABLISHED
List open files and can help identify the processes associated with network connections; example will show processes that are using port 80 for network connections.
sudo lsof -i :80
ethtool
To get information about your Ethernet interface, you can use:
ethtool eth0
Replace eth0 with your actual interface name.
iftop
iftop is a real-time console-based network bandwidth monitoring tool.
sudo iftop
iftop primarily displays a real-time, interactive view of network bandwidth usage. While it shows the hosts that your system is communicating with, it doesn't directly provide information about the specific software or process associated with each connection.
