Netstat-monitor is a command line tool for monitoring network connections. Its output is similar to the output from the netstat command with the options "netstat --inet -alp". Netstat-monitor can be left running, though, and will report new connections as they are made. Also, filters can be used to limit what's displayed to just what's unexpected or interesting.
Netstat-monitor has been tested on Debian 11 Bullseye, which uses Python 3.9 and the Linux 5.10 kernel. It should work on other distros that have the same format for the socket files in /proc/net (tcp, tcp6, udp, and udp6.) Netstat-monitor does a quick preliminary check on start-up to see if those files have the expected header line. Previous versions of netstat-monitor were tested on Debian 7 (Wheezy) and Ubuntu 12.04, which were based on the Linux 3.2 kernel.
To clone the repo from GitHub and run netstat-monitor directly, on a Debian based distro:
$ sudo apt-get install python3-netaddr
$ cd /tmp
$ git clone https://github.com/stalexan/netstat-monitor.git
$ cd netstat-monitor
$ ./netstat-monitor
Or, to create an installable package (tarball):
$ sudo apt-get install python3-build
$ cd /tmp
$ git clone https://github.com/stalexan/netstat-monitor.git
$ cd netstat-monitor
$ python3 -m build
This creates the tarball netstat-monitor-1.1.4.tar.gz in ./dist. To install:
$ sudo apt-get install python3-pip
$ cd ./dist
$ pip install netstat-monitor-1.1.4.tar.gz
This installs to ~/.local/bin. To run:
$ ~/.local/bin/netstat-monitor
Or to instead install to /usr/local/bin run pip install as root:
$ sudo pip install netstat-monitor-1.1.4.tar.gz
To run:
netstat-monitor
Here's some sample output:
Time Proto ID User Local Address Foreign Address State PID Exe Command Line
Sep 16 14:20:50 tcp 1 root 0.0.0.0:22 0.0.0.0:0 LISTEN 875 /usr/sbin/sshd /usr/sbin/sshd -D
Sep 16 14:20:50 tcp 2 root 127.0.0.1:631 0.0.0.0:0 LISTEN 927 /usr/sbin/cupsd /usr/sbin/cupsd -F
Sep 16 14:56:13 tcp 3 root 192.168.1.4:22 other.com:41453 ESTABLISHED 24639 /usr/sbin/sshd sshd: alice [priv]
Sep 16 17:21:17 tcp 4 sean 192.168.1.4:32998 ocsp.entrust.net:80 ESTABLISHED 4872 /usr/sbin/firefox /usr/sbin/firefox
Sep 16 18:28:30 udp 5 root 0.0.0.0:1194 0.0.0.0:0 CLOSE 29906 /usr/sbin/openvpn openvpn settings.ovpn
Sep 16 18:39:42 udp 6 sean 192.168.1.4:48742 192.168.1.1:53 ESTABLISHED 31160 /usr/bin/ssh ssh git@github.com git-receive-pack 'stalexan/netstat-monitor.git'
Filters can be used to limit what's displayed to just unexpected or interesting connections. A typical use case is to run netstat-monitor without any filters at first, and then add filters over time until only interesting connections are displayed.
Filters are created in config files that are listed on the command line. For example:
netstat-monitor sample-filters
The file sample-filters is provided with the install, and has some example filters. A few of them are:
[ntpupdate]
exe: /usr/sbin/ntpdate
user: root
[firefox]
exe: /usr/lib/firefox/firefox
user: alice
remote_ports: 53, 80, 443, 8080
[upstart]
exe: /sbin/upstart-udev-bridge
user: root
states = FIN_WAIT1, FIN_WAIT2, TIME_WAIT, CLOSE, CLOSE_WAIT, LAST_ACK, CLOSING
[ignore-lan]
remote_ips: 192.168.1.0/24
Each section defines a new filter. A section starts with the filter name, enclosed in square brackets. The name can be any alphanumeric string. Each line after that defines a filter parameter. For example, the first section defines a filter called ntpupdate that has two parameters: exe and user. This filter will look for connections with exe set to /usr/sbin/ntpupdate and user set to root. Any connections with these settings will be filtered out, and not displayed.
The available filter parameters are:
- exe: The executable for the process that opened the connection.
- cmdline: The command line of the process that opened the connection.
- cmdline_is_re: Whether cmd_line is a regular expression (true/false). Default is false.
- pid: The pid of the process that opened the connection.
- user: The user for the process that opened the connection.
- local_hosts: Comma separated list of local hosts.
- local_ports: Comma separated list of local ports.
- remote_hosts: Comma separated list of remote hosts, specified with domain names.
- remote_ips: Comma separated list of IP address ranges, in CIDR notation.
- remote_ports: Comma separated list of remote ports.
- states: Comma separated list of Connection states.
There's a command line parameter that acts as a kind of filter as well: --ignore-loopback. It will cause any connections on the loopback address (127.0.0.1) to be filtered out. By default it's false.