Hi all,

I was wandering if there is a tool (lsof/ethereal/netstat alike) that can show the following connection: client <- server -> internet.
Seen from the server, which has iptables running.

Netstat (-an) and lsof (-i) don't show these connections and ethereal does show both connections, but as seperate streams on 2 different interfaces.

I guess the kernel(iptables) 'translating' packets is the reason for that (and the mentioned tools listening on sockets/(net)devices).

Ethereal (or alike) could be used, but it's no fun figuring out which incomming packet was translated' to which outgoing packet. Would be nice if the complete stream could be seen/followed.

So, I'm looking for a tool, commandline driven if possible, that can show these connections.

Thanx in advance.

have u tried snort ? as i remember snort can catch packets. and also can be used as content filter program. www.snort.org

i hope this helps u.

Will install it and give it a try. A quick scan over the documentation looked promising.

Thanks for the tip.