How to log all ESTABLISHED connection

catiewong · 12-13-2018, 02:25 AM

Quote:

Originally Posted by scasey

Ahh.

Code:

netstat -tnlp

will show you all services that are listening.
Those are the services you'd need to set up on the new server...

Looking at/for ESTABLISHED connections will only tell you which services are being used at the time you take a snapshot. Theoretically that might (probably will) be a subset of the services you need to set up.

thanks , the command you provided may show all connnnected service , but if I would like to know the service in a certain of time has been running , how to check ?

scasey · 12-13-2018, 10:09 AM

Quote:

Originally Posted by catiewong

thanks , the command you provided may show all connnnected service , but if I would like to know the service in a certain of time has been running , how to check ?

That command does NOT show you connected services...it shows you services that are running when you execute the command.
Listening services (servers/daemons) are (usually) running all the time. You should see something like (local address munged)

Code:

netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 192.168.0.26:25         0.0.0.0:*               LISTEN      9114/tcpserver      
tcp        0      0 192.168.0.27:443        0.0.0.0:*               LISTEN      6724/httpd          
tcp        0      0 192.168.0.28:22         0.0.0.0:*               LISTEN      1174/sshd          
tcp        0      0 192.168.0.26:587        0.0.0.0:*               LISTEN      9123/tcpserver      
tcp        0      0 127.0.0.1:3310          0.0.0.0:*               LISTEN      28562/clamd         
tcp        0      0 192.168.0.26:110        0.0.0.0:*               LISTEN      9131/tcpserver      
tcp        0      0 192.168.0.26:143        0.0.0.0:*               LISTEN      15433/dovecot       
tcp        0      0 192.168.0.27:80         0.0.0.0:*               LISTEN      6724/httpd          
tcp        0      0 192.168.0.27:21         0.0.0.0:*               LISTEN      2310/ncftpd

So, I'd need to install the following services on a new server to replicate what's running here:
tcpserver
httpd
sshd
clamd
dovecot
ncftpd

This server uses tcpserver to control the qmail email services running on it, as can be seen by the local port numbers 25, 587, 110 it's using. I know I'd need to install and configure qmail, too, 'cause it's my server and I know what's running on it.
The command on your server would likely show postfix or sendmail or whatever MTA you're running.

Again ESTABLISHED connections only tells you which of those services are connected to a foreign address at the time you run the command.
It does not tell you what you asked for in #14 (finally*), which is to identify which services you need to install on a new server.

*Aside: If you'd stated your actual purpose in your original post, we could have better helped you earlier in the thread.

astrogeek · 12-13-2018, 02:13 PM

Please review the Site FAQ for guidance in posting your questions and general forum usage. Especially, read the link in that page, How To Ask Questions The Smart Way. The more effort you put into understanding your problem and framing your questions, the better others can help!

scasey's answer in post#15 tells you what are now asking for, which is in fact very different than what you asked in your original post.

Please be respectful of the time volunteered by others to provide answers by putting more effort into understanding your own requirements before asking your questions.

scasey · 12-16-2018, 11:55 AM

catiewong: No more responses?
It would be polite to at least acknowledge the help you've received...
One other thought: The command

Code:

systemctl | grep running

Will show you all the services that are currently running, including those that do not "LISTEN" at a port.