network traffic for a give user
OS : CentOS 5.3 64bit
How to trace incoming and outgoing network traffic for a give user? User 'A' logs in to the system and does various network connectivity As root user need to find what are the outgoing and incoming connection that are related with user 'A'. basically need to check the connection flow. netstat will show ESTABLISHED, LISTEN etc.. need something like tcpdump Eg:- --user option for tcpdump tcpdump -vv -nn -i eth0 host 10.200.2.1 and tcp dst port 8080 --user A Can someone tell me any tool which can do such thing? Even if it can show the process ID of the client application which is trying to establish network connectivity will do. |
No. There's the Owner module for iptables which you could use to filter the connection creations with their UID's (and so with a limited number of user accounts you could have a separate rule for each user to log their traffic as it's not apparently possible to dynamically substitute the user in to the log message), but to directly view it like you want goes between too many layers of the system. by the time tcpdump inspects the data, it is long past being related to a user request.
|
All times are GMT -5. The time now is 05:10 AM. |