I need to see what other applications or servers are connecting to my server, and log them over time.
I only want to grab source/destination IP and ports, and use them to build a list of hosts using this server over time. I've tried a couple different tools for this:
- Netstat: If a client connection is short, netstat output doesn't catch it.
- Procmon: More resource intensive, and doesn't seem to catch incoming SMB connections (maybe I'm doing something wrong here, it catches everything else)
- Wireshark: I'm not sure what a good filter to use is. It collects so much data that it gets out of control quickly - I will need to monitor for a few weeks.
Any recommendations on a lightweight tool that will handle this?
0 Answers