2

Is there a linux server utility that can list the network ports and protocols that have been active over a given period of time?

For example, I'd like to know which ports and protocols were active at least once last week. The answer would be something like: TCP/80, TCP/443, UDP/5678...

Numid
  • 121

2 Answers2

3

You can install and activate auditd. Add there rules in audit config:

-a always,exit -F arch=b64 -S connect -F key=CONNECT
-a always,exit -F arch=b64 -S bind -F key=BIND
-a always,exit -F arch=b64 -S socket -F key=SOCKET
-a always,exit -F arch=b64 -S listen -F key=LISTEN
-a always,exit -F arch=b64 -S shutdown -F key=SHUTDOWN
-a always,exit -F arch=b64 -S close -F key=CLOSE

and you will have in audit logs you can monitor socket related system calls.

If you want to find now old information (and do not have audit) I do not think you will find relevant information in linux.

Romeo Ninov
  • 6,677
0

An alternative to tracing within hosts' network stack is tracing traffic on the wire.

Take a packet capture of the interfaces in question. Either on that host, or somewhere in the path.

Various tools exist to parse that, definitely TCP and UDP information and possibly some insights into applications. Wireshark is free, but its far from the only packet analysis tool.

John Mahowald
  • 36,071