I'm merging some code I got 6 months ago for checking the "netstat" output for what ports are being used - both for active connections and listen-ports.
For that, I need the "netstat" commands to put into the client code, and an example of the output so I can tell the client-module how to interpret the data.
I'm only interested in TCP ports. I have the data I need for Linux, Solaris and the BSD variants, but I would like them also for AIX, HP-UX, Darwin and OSF/1.
So I need:
The "netstat" command to run to get the set of TCP ports currently in use, including ports used for incoming connections. Typically this will be some sort of "netstat -na", with some extra options to get only the TCP sockets. Note that it may be necessary to run two commands to get both IPv4 and IPv6 ports. On the BSD's, I noticed that connections to the loopback interface register as IPv6 sockets, not IPv4.
A sample of the output, so I can see which columns the various data go into.
Anyone there who could get me this info ?
Thanks, Henrik
PS: This lets you setup rules in hobbit-clients to track eg the number of connections to your webserver, and put this into a graph so you can see the activity over the day. It can also alert you if there is a port 25 open on a server where it shouldn't be, or if the number of connections to your ssh daemon goes above 20.