From owner-freebsd-questions@FreeBSD.ORG Tue Apr 20 11:49:05 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1A3CB106566B for ; Tue, 20 Apr 2010 11:49:05 +0000 (UTC) (envelope-from marcus.dicotomia@archlinux.com.br) Received: from mail-vw0-f54.google.com (mail-vw0-f54.google.com [209.85.212.54]) by mx1.freebsd.org (Postfix) with ESMTP id C9F448FC21 for ; Tue, 20 Apr 2010 11:49:04 +0000 (UTC) Received: by vws18 with SMTP id 18so732766vws.13 for ; Tue, 20 Apr 2010 04:49:04 -0700 (PDT) Received: by 10.220.129.10 with SMTP id m10mr4570207vcs.43.1271762822125; Tue, 20 Apr 2010 04:27:02 -0700 (PDT) Received: from archdesk.localnet ([201.19.141.89]) by mx.google.com with ESMTPS id x6sm23338027vco.23.2010.04.20.04.26.59 (version=SSLv3 cipher=RC4-MD5); Tue, 20 Apr 2010 04:27:01 -0700 (PDT) From: marcus To: freebsd-questions@freebsd.org Date: Tue, 20 Apr 2010 08:26:37 -0300 User-Agent: KMail/1.13.2 (Linux/2.6.33-ARCH; KDE/4.4.2; i686; ; ) References: <20100415201645.2ef97db4@TheHughesLogcabin.net> In-Reply-To: <20100415201645.2ef97db4@TheHughesLogcabin.net> MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <201004200826.37826.marcus.dicotomia@archlinux.com.br> Subject: Re: about tcpdump X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Apr 2010 11:49:05 -0000 On Thursday 15 April 2010 22:16:45 Michael Hughes wrote: > On Thu, 15 Apr 2010 23:37:09 +0300 >=20 > Yavuz Ma=C5=9Flak wrote: > > I have a network. I wish to log all incoming and outgoing trafficc > > using tcpdump on my gateway server. But I don't want to log these > > traffic's data because of they take up much on disk. > > I only want to log which ports were used, which ip addresses were > > reached. How can I do these using tcpdump ? > > Could you give me an example or docs? > > I use freebsd7.2 >=20 > Have you thought about using ARGUS (Audit Record Generation and > Utilization System)? tcpdump syntax for a specific host: #tcpdump -i rl0 -n host 10.10.0.1 rl0 =3D interface 10.10.0.1 =3D your host tcpdump syntax for a specific port: #tcpdump -i rl0 -n port 22 22 =3D your port However your questions is more about filtering data using shell scripts tha= t=20 tcpdump syntax. If you isn't mastered it, tool as ARGUS are a good choice.