Dear all,

One of my colleague told me that
ngrep is before iptables -> meaning that if i setup my iptables to block some traffic, doing an ngrep will still allow me to see the attempts coming in.
is it correct ?
I try to simulate the above statement by.

On my server console

On my client console, open putty, choose ssh and input the server ip, and try to connect.

On my server console, i saw this

It seems that everytime i try to attempt to connect, i saw a "#"
being display.

Q1) What is the "#" display ?
Q2) In this case, how do i confirm that the incoming ssh request did indeed reach my server (since i cant see any content or source ip information at all) ?

Regards,
Noob

Help anyone ?

I know its 2 months since you posted your question, but I too am looking for the answer to this.

Hello,

If you set the INPUT policy to DROP, don`t expect to see anything on any interface, because it drops all packets.
At least if you DROP all, try:
iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "ssh Incoming port" -j ACCEPT

Then, you can make the capture with ngrep.
The correct order is: ngrep -d ethX port 22.

Also you can capture with tcpdump, tshark/wireshark.

Hope helps.

1 members found this post helpful.