Re: [PLUG] What's the best utility to find source of outbound net traffic?

[Dan Widyono <dan@widyono.net>]

> > Um, that's every *two seconds*.  That seems more worrisome to me (on my
> > system) than every few minutes.
> 
> Well, ntp, cups, samba, syslog, name resolution, nfs, portmapper,
> plenty more.  There is a lot of legitimate udp traffic on most networks.

Well, that's why I specified (on my system).  Outbound to that there Internet
thingy, I have very little udp traffic.  I certainly don't allow nfs,
portmapper, samba, syslog, nor cups out to the public (which is the direction
I believe the original poster was concerned about).  dns and ntp are not
every two seconds (in my experience, since it's not a major server I'm
running for other folks).  I don't know (remember?) what the original poster
had set up, but regardless, I agree with your iptables monitoring idea
(having used it successfully myself for similar issues).

Dan W.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug