Q. I've Linux box acting as software router (natted) for over 100 computer connected via LAN. Regular netstat command is not displaying the list of all natted connections. How do I find out connections managed by netfilter / iptables which comes with the Debian 4.x system?
A. You cannot use regular netstat command to display NAT connections managed by iptables. You need to use netstat-nat command. You can also use /proc/net/ip_conntrack or /proc/net/nf_conntrack, which is the temporary conntrack storage of netfilter.
Install netstat-nat
Use apt-get command under Debian / Ubuntu Linux, enter:
$ sudo apt-get install netstat-nat
Source code / RPM file
If you are using Suse / Redhat Linux, grab source code or RPM file here:
How do I use netstat-nat command?
Login as root user and type the following to display list of all natted connections:
# netstat-nat -n
To display NAT connections with protocol selection, enter:
# netstat-nat -np
To display all connection by source IP called 192.168.1.100
# netstat-nat -s 192.168.1.100
To display all connections by destination IP/hostname called laptop, enter:
# netstat-nat -s laptop
To display SNAT connections, enter:
# netstat-nat -S
To display DNAT connections, enter:
# netstat-nat -D
To display only connections to NAT box self i.e. doesn’t show SNAT & DNAT, enter:
# netstat-nat -L
To display help, enter:
$ netstat-nat -h
$ man netstat-nat
You should follow me on twitter here or grab rss feed to keep track of new changes.
Featured Articles:
- 30 Handy Bash Shell Aliases For Linux / Unix / Mac OS X
- Top 30 Nmap Command Examples For Sys/Network Admins
- 25 PHP Security Best Practices For Sys Admins
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- Linux: 20 Iptables Examples For New SysAdmins
- Top 20 OpenSSH Server Best Security Practices
- Top 20 Nginx WebServer Best Security Practices
- 20 Examples: Make Sure Unix / Linux Configuration Files Are Free From Syntax Errors
- 15 Greatest Open Source Terminal Applications Of 2012
- My 10 UNIX Command Line Mistakes
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- The Novice Guide To Buying A Linux Laptop
{ 4 comments… read them below or add one }
I’ve been using iptstate at home to look at connections, but it’s more like top for network connections through IPTables.
netstat-nat is a lot more flexible — especially when I have people over who are IMing and surfing all over the place.
Thanks for the info.
You can use the conntrack command as well (in fedora it is in the conntrack-tools package ).
It has a nice feature to watch the events in “real-time”…
Just as a side note you may want to make a note that the kernel must have netfilter enabled or loaded as a module
I like tool: iptstate – display realtime connection/nat state, can filter output by IP (src/dst) and port and run in text mode / console.