Tuesday, September 11, 2007

tcptrack - Connection Trace Utility

Well here goes. Forgive my newbie-ness when it comes to blogging. I will get the hang of it soon.

My first real article will be about a linux network tool I found called TCPTrack. I generally use Centos and Redhat Linux versions and I have found that this tool has helped me several times.

What this tool does is display a list of connections on a specific network adapter.
It is invoked from a command shell in Linux using the following command

tcptrack -i eth0

where eth0 is the network interface you would like to monitor.

The tool gives information as to the source and destination IP addresses and ports. This tool is available on rpmfind.net as well as in some linux repos.

As an example of why I used this was to trace the connections to a mail server that were sending spam messages repeatedly. I was able to determine the offending IP address and block it from further spam.

As a network admin I recommend adding this app to your tool kit.

No comments: