I know the command "netstat -na " may output all running service .

If I would like to know what service has been " ESTABLISHED " , their incoming IP etc information has been running / connected to the server .

I just would like to log all running service which it has been " ESTABLISHED " , may I know how to do it , would advise how to write such script .

> How to log all ESTABLISHED connection
or even:

Which kind of service? If you are using iptables or netstat or tcpdump then you are only tracking the state of the TCP (presumably not UDP) connection at layer 4 aka the transport layer and not the service itself which would be layer 7 aka the application layer.

1 members found this post helpful.

All service are established .

Thanks your advise , your script may be work , if I would like to know the details of established service in period of time ( paat and future time ) , eg. from 2018-10-01 to 2018-12-31 , is it possible ?

AFAIK, the state of a connection as reported by netstat is transitory. I don't know that it's logged anywhere...nor, probably, would we want it to be.

Unless you have logged everything between 2018-10-01 to 2018-12-31 what is past is gone.

In particular, the ESTABLISHED state as discussed here is a property defined by netfilter/iptables and is derived by netstat from the current state of kernel network processes. For non-TCP connections the ESTABLISHED state is entirely a fabrication of netfilter/iptables, so the only way to log that really would be to add an appropriate rule similar to this...

...where CHAINNAME is where you want to place the rule, usually INPUT or OUTPUT, and LOGGER is the logging facility you want to use (probably LOG, NFLOG or ULOGD, each with appropriate optional arguments).

@OP: is this a homework assignment or an actual problem?

If the past is gone , what can I do if I start to log the information from now ?

Read the logs... ?

I am not sure I understand the question.

I think it is confused .

If the past infomration can not be get , how to start to log the information from now ?

It is confusing. Pleas rephrase which services you wish to log and the nature of the information you wish to collect.

1 members found this post helpful.

Your thread title How to log all ESTABLISHED connection, and original question...

And when asked about whether you need only TCP connections or other such as UDP, you replied...

...I take to mean you want to log all connections which pass through the ESTABLISHED state.

To do that you will need an iptables rule because UDP, ICMP, SCTP and potentially other protocols exist in the ESTABLISHED state only in netfilter/iptables context.

I gave an example of an iptables rule that you can adapt for that, but you will need to decide how you want to log those and configure the corresponding logging target.

You can begin to learn how to do that by looking at the man pages for iptables-extensions and ulogd, and searching for resources online.

If you need more help here, or if this does not seem to do what you need, it will be very helpful if you can try to explain very clearly just what your actual goal is.

As I will migrate this server to anohter server , I need to know what service is using in it so that I can setup such service to new server .

therefore , I would like to know all service has running in it .

Ahh. will show you all services that are listening.
Those are the services you'd need to set up on the new server...

Looking at/for ESTABLISHED connections will only tell you which services are being used at the time you take a snapshot. Theoretically that might (probably will) be a subset of the services you need to set up.

1 members found this post helpful.