collecting connection data
May 19, 2011
Let’s say I want to collect the following info on a set of servers locally to the system:
– any tcp or udp connection (in or out) and the source and dest ports – but only to or from a specific set of hosts.
– uniqued so I don’t have more than one copy of any connection
what would be the least invasive way to do that? I thought of something like tcpdump – but that seems expensive. I also thought about trying to do something like it with iptables logging – but I’m not sure how much control I can get from the output of the logs.