TCPDUMP command to get source, destination, and port only. Removing duplicates

gbarnes27 · 08-06-2018, 03:23 PM

I have several applications that I am moving to a different datacenter. I need to understand all connectivity for each application destination and port. Does anyone know if a simple command that would capture just the source IP, the destination address/IP and port. I would also like to not have duplicates. I appreciate any and all help.

Thanks
Greg

scasey · 08-06-2018, 03:31 PM

Simple? I don't know one.
I'd think you'd need to analyze the log files for each server/service being run, since the port would be a per service thing (httpd on 80/443, ssh on 22, email on 25, etc.)..but maybe others have other ideas.