I'm just getting the hang of things with my Linux VM server and I'd like to find a monitoring tool that will let me view packets, connection attempts from outside, attacks, things of that nature. I realize this is a broad topic that could lead to many other questions but all I'm really looking for are suggestions for open source software that can accomplish the type of things I've mentioned above.

Hi,

Wireshark is what your after. Tcpdump is alright too, but Wireshark has a nice GUI. I use it for monitoring network traffic and if one of the servers is having the blues.

You might also want to look at this
http://resources.infosecinstitute.co...raffic-mining/

And more broadly.
www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf is a fair bit of reading if i recall, but more reading the better.
Very old, but still informative, they made us watch this in 1st year college, i find it easier to learn if i have something to visualize.
http://www.youtube.com/watch?v=xIuBmOufbls

Hope i've helped....

1 members found this post helpful.

Given servers usually are headless, risk should be minimized and resources should be spent wisely it IMHO should be the other way around: use tcpdump (or Wiresharks command line equivalent rawshark) for just capturing packets on the server and Wireshark, or any other network traffic analysis tool, on the analysis workstation.


First I'd like to add that proper hardening, in your case of the host and virtualization guest, should be aimed at reducing exposure and therefore risks. That should make regular auditing more efficient and less effort and time needed for monitoring. If you're only after logging network connections then you can use firewall rules with "-j LOG" filters, capturing packets I commented on above, and active traffic classification, possibly combined with packet capture, you can do with an IDS like Snort, Prelude or Suricata. I can't emphasize enough that proper hardening, preferably prior to exposing the server, is key.

1 members found this post helpful.

unSpawn,0men,

Thank you for taking the time to respond. Your answers were both really helpful. I'll start having fun with these tools when I get home from work today. My Xen VM server is at home not at work unfortunately. Ah well you have to start somewhere.