Hello all,
I would like to trigger a given application (ffmpeg video encoder) when network traffic (streaming) is detected on a given port (for example: UDP/4001).
I don't mind if some packets are lost before the application is triggered.
I would also like to stop/kill the application when the traffic ends.
Does anyone know how this could be achieved?

My hints for the moment:
- Using port-knocking (knockd) but the devices that generates the traffic are hardware encoders so they cannot knock pre-defined ports before sending traffic. One solution could be to use the trigger sequence=4001:udp,4001:udp,4001:udp
- Monitor syslog (as fail2ban does) and detect iptables log on the given port

In both cases, my log files might get huge if all my UDP streaming traffic is logged.

Not easy as it seems... Any clue is welcome.

Thanks

inetd is your friend.

Thank you for the quick reply. That is exactly what I was looking for.
Yet, I face a problem when xinetd triggers the ffmpeg encoder that tries to read traffic from the given UDP port (UDP/3000 in my case), ffmpeg cannot start and gives the following error:

[udp @ 0x1de60a0] bind failed: Address already in use
udp://localhost:3000: Input/output error

and indeed, when xinetd is running, the port 3000 appears in netstat:

# netstat -tuan | grep 3000
udp 0 0 0.0.0.0:3000 0.0.0.0:*

If I stop xinetd and launch my ffmpeg script manually, it works fine. Is that the normal behaviour of xinetd?