Q. How do I track and monitor connection for eth1 public network interface under Redhat Enterprise Linux (RHEL) 5 server?

A.You can use netstat command or tcptrack command. Both command can show established TCP connection and provides the ability to monitor the same.

netstat command

netstat command prints information about the Linux networking subsystem. It also works under UNIX and *BSD oses. It can display network connections, routing tables, interface statistics, masquerade connections, and multicast memberships etc.

netstat command to display established connections

Type the command as follows:
$ netstat -nat

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0*               LISTEN     
tcp        0      0 *               LISTEN     
tcp        0      0    *               LISTEN     
tcp        0      0 *               LISTEN     
tcp        0      0*               LISTEN     
tcp        0      0  *               LISTEN     
tcp        0      0    *               LISTEN     
tcp        0      0 *               LISTEN     
tcp        0      0  *               LISTEN     
tcp        0      0  *               LISTEN     
tcp        0      0*               LISTEN     
tcp        0      0*               LISTEN     
tcp        0      0         ESTABLISHED
tcp        0      0         TIME_WAIT  
tcp        0      0          ESTABLISHED
tcp        0      0         ESTABLISHED
tcp        0      0        ESTABLISHED
tcp        0      0         TIME_WAIT  
tcp        0      0         ESTABLISHED
tcp        0      0         ESTABLISHED
tcp6       0      0 :::53                   :::*                    LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN 

To display client / server ESTABLISHED connections only:
$ netstat -nat | grep 'ESTABLISHED'

tcptrack command

tcptrack command displays the status of TCP connections that it sees on a given network interface. tcptrack monitors their state and displays information such as state, source/destination addresses and bandwidth usage in a sorted, updated list very much like the top command.

Install tcptrack

Redhat (RHEL) / Fedora / CentOS user, download tcptract here. For example download RHEL 64 bit version:
# cd /tmp/
# wget http://dag.wieers.com/rpm/packages/tcptrack/tcptrack-1.1.5-1.2.el5.rf.x86_64.rpm
# rpm -ivh tcptrack-1.1.5-1.2.el5.rf.x86_64.rpm

Debian / Ubuntu Linux user use apt-get as follows:
$ sudo apt-get install tcptrack

How do I use tcptract to monitor and track TCP connections ?

tcptrack requires only one parameter to run i.e. the name of an interface such as eth0, eth1 etc. Use the -i flag followed by an interface name that you want tcptrack to monitor.
# tcptrack -i eth0
# tcptrack -i eth1

Redhat Enterprise Linux 5 / CentOS 5 monitor and track TCP connections on the network (eth0)
(tcptrack in action)

You can just monitor TCP port 25 (SMTP)
# tcptrack -i eth0 port 25

The next example will only show web traffic monitoring on port 80:
# tcptrack -i eth1 port 80

tcptrack can also take a pcap filter expression as an argument. The format of this filter expression is the same as that of tcpdump and other libpcap-based sniffers. The following example will only show connections from host
# tcptrack -i eth0 src or dst

For further option please refer to man page of netstat and tcptrack command.

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 19 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersncdu pydf
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
19 comments… add one
  • Jeferson Passos Nov 14, 2007 @ 13:44

    I am trying to install tcptrack in my linux fedora.
    I did:
    # yum install tcptrack.x86_64
    The system give me the msg:
    Error: Missing Dependency: libpcap.so.0.8.3()(64bit) is needed by package tcptrack

    Then I tried to install libpcap packet with the command:
    # yum install libpcap.x86_64
    The system give me the msg:
    Package libpcap – 14:0.9.7-1.fc7.x86_64 is already installed.
    Nothing to do

    Can anyone help me ??
    Jeferson Passos

  • Oleg Frayman Jul 21, 2008 @ 20:07

    try yum –whatprovides libpcap.so.0.8.3, you might need to install libcap.i386 or libcap-devel..

  • Amit Feb 23, 2009 @ 7:14

    Hi, I want to watch my computer IP & Network.Which DOS command I should use to FIND out that whether someone is connected to my computer or not in intrusion way or not. Tell me the method to preventing un-authorised access to my computer??

  • mostofa Sep 15, 2009 @ 13:03

    thanks for ur information now i monitor my network

  • Ruel Joson Oct 11, 2009 @ 10:58

    I encounter Failed dependencies when trying to rpm the package

    # rpm -ivh tcptrack-1.1.5-1.2.el5.rf.x86_64.rpm
    warning: tcptrack-1.1.5-1.2.el5.rf.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6
    error: Failed dependencies:
    libc.so.6()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libc.so.6(GLIBC_2.2.5)(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libc.so.6(GLIBC_2.4)(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libgcc_s.so.1()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libgcc_s.so.1(GCC_3.0)(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libm.so.6()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libncurses.so.5()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libnsl.so.1()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libpcap.so.0.9.4()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libpthread.so.0()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libpthread.so.0(GLIBC_2.2.5)(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libpthread.so.0(GLIBC_2.3.2)(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    librt.so.1()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libstdc++.so.6()(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libstdc++.so.6(CXXABI_1.3)(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64
    libstdc++.so.6(GLIBCXX_3.4)(64bit) is needed by tcptrack-1.1.5-1.2.el5.rf.x86_64

    Please help. Thanks

  • Claudio Nov 26, 2009 @ 15:03

    If you got errors on dependencies probably you have a 32bit system so follow these steps:
    # cd /tmp/
    # wget http://dag.wieers.com/rpm/packages/tcptrack/tcptrack-1.1.5-1.2.el5.rf.i386.rpm
    # rpm -hiv tcptrack-1.1.5-1.2.el5.rf.i386.rpm
    Have a nice day!

  • Srikanth Mar 3, 2010 @ 2:11

    Appreciate it…. it was very useful in finding why applet was not respondig after it uploaded certain MB.

  • Somaikeres Mar 11, 2010 @ 13:19

    running 32-bit CentOS 4 (I guess…) and when trying to install tcptrack I get this shit:
    [root@localhost tmp]# rpm -hiv tcptrack-1.1.5-1.2.el5.rf.i386.rpm
    warning: tcptrack-1.1.5-1.2.el5.rf.i386.rpm: V3 DSA signature: NOKEY, key ID 6b8d79e6
    error: Failed dependencies:
    libc.so.6(GLIBC_2.4) is needed by tcptrack-1.1.5-1.2.el5.rf.i386
    libpcap.so.0.9.4 is needed by tcptrack-1.1.5-1.2.el5.rf.i386
    rtld(GNU_HASH) is needed by tcptrack-1.1.5-1.2.el5.rf.i386


  • Ruel Joson Apr 11, 2010 @ 7:35

    i downloaded the package and install it, but when i try to run the tcptrack i encounter this:

    tcptrack: error while loading shared libraries: libpcap.so.0.8.3: cannot open shared object file: No such file or directory

    please help. thank you!

  • muchikon Sep 10, 2010 @ 13:53

    Exelent tool, great info
    Thats why I love debian, cause is very simple to install things.

  • Unlocker Nov 18, 2010 @ 17:01

    You need to update libpcap before install tcptrack

    # yum install libpcap -y
    # wget http://dag.wieers.com/rpm/packages/tcptrack/tcptrack-1.1.5-1.2.el5.rf.$(uname -m).rpm
    # rpm -ivh tcptrack-1.1.5-1.2.el5.rf.$(uname -m).rpm
    # tcptrack -i eth0
    Done !!

  • Adarsh Feb 17, 2011 @ 5:35

    I need to know whether my Linux 4 is 64 bit or 32 bit. Can someone please help me out.

    • Sibe Apr 10, 2011 @ 7:39

      You can use ‘uname’ command.

      uname -i will print your machine arch; i386 means 32bit, x86_64 for 64 bit arch.
      uname -r prints your kernel version, if you have a 64bit kernel version running, you’ll notice it.

  • Catalin Sep 25, 2011 @ 20:11

    I got error on Fedora 15 when
    # tcptrack -i eth0 src or dst xxx.xxx.xxx..xxx
    where xxx.xxx.xxx..xxx is one ip the error is
    pcap_compile: syntax error
    I check libpcap seam to be ok :
    Package 14:libpcap-1.1.1-3.fc15.i686 already installed and latest version
    Any idea ?

  • vikas kumar Oct 2, 2011 @ 13:58

    Thanks, i have installed successfully package tcptrack and now i monitor my network.

  • tudor Nov 22, 2011 @ 9:11

    Thanks all , good idea .. I also installed successfully

  • yak Nov 10, 2012 @ 23:23

    RedHat/CentOS/etc users. Go to http://pkgs.repoforge.org/tcptrack and find the name of the package most suitable for your system. For example, for me on an Amazon Linux instance, tcptrack-1.4.0-1.el6.rf.x86_64.rpm was most appropriate.

  • steve Mar 13, 2015 @ 17:08

    I installed 1.4.0 for 64bit.
    If I try to specify any type of filter I get this:

    [root@evest-psmtp-01 ~]# tcptrack -i eth0 src

    If I just do interface as a whole, it works. I’m on centos 6.6 64bit.

    • Roque Mar 24, 2015 @ 19:35

      i have the same setup as Steve (post #18) and the same result.

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum