V
V
Vadim Timoshenko2019-04-10 11:33:42
ubuntu
Vadim Timoshenko, 2019-04-10 11:33:42

How to enable outgoing traffic logs in ubuntu?

There is VDS on Ubuntu. My server is knocking on other decent servers. Somewhere sits a bastard. I want to find him. Where to look for logs and if there are none, how to enable them?
What is the easiest way to monitor the source of an outgoing connection?
I set rules for iptables. But I'm afraid that GET requests are being made through ports 80 and 443?

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-N f2b-sshd
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m multiport --sports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Answer the question

In order to leave comments, you need to log in

1 answer(s)
R
Ronald McDonald, 2019-04-10
@PbI6A_KuT

Run tcpdump, then view the logs in Wireshark.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question