I'm operating a couple of server daemons that use udp to communicate with large number of clients. How do I find and list out all the active udp "connections" that are talking to the servers in order to estimate the num of active clients that are connected to the server daemons? I couldn't think of an easy way to do this besides sniffing the packets with tshark or tcpdump and look at the source ip of udp packets going to the server daemons and yes, I know UDP is connectionless and stateless protocol.
Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port.
The equivalent tcpdump command would be:
tcpdump -s 0 -i any -w mycapture.trc port 80 host google.com
which outputs :
46 packets captured
131 packets received by filter
0 packets dropped by kernel
I'd like something similar that outputs:
54 bytes out, 176 bytes in
I'd like it to work on RHEL and be free/open-source. It would be good if there was an existing tool which I was just missing too!
Wireshark | Windows
I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a search or filter for the specific string I'm looking for.
Is there a way to do this in Wireshark?
I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few rules).
Something like Wireshark for Iptables. Or maybe even something similar to a debugger for a programming language.
Thanks Chris
Note: It doesn't have to be a fancy GUI tool. But it must do more than just showing a package counter or so.
Update: It almost looks as if we can't find anything that provides the functionality that is asked for. In that case: Let's at least find a good technique that's based on iptables logging - which can be easily turned on and off, and doesn't require to write iptables rules redundantly (having to write the same rule for -j LOG and -j ...)
I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP.
Just using Decode_As on the menu seems to allow half the conversation but only one side.
Any suggestions how to make this a permanent option?