Security Log to see who is…

[Nas.CloudBusinessPortal]

Id like to track who in connecting to a device on my my network.

The port numbers are 12090 and 12080, just to keep track.

Is there an ezasy way to generate a automatic log?

 

[eibgrad]

Are we talking about local<->remote access of those ports? Because you can NOT readily track access between local devices using the router.

If it's NOT local<->local access, I suppose you could just look for those ports in the PREROUTING chain of the nat table and dump them to the syslog.

iptables -t nat -I PREROUTING -p tcp -m multiport --dports 12090,12080 -j LOG

Then browse the entries found in the syslog.

grep -E 'kernel:.* DPT=(12090|12080) ' /tmp/syslog.log | less

For long term usage, the nat rule would have to be installed as a nat-start script. But for short term usage, you can just use ssh.

P.S. You might have to increase the syslog level to debug for the LOG entries to work.

 

[Justinh]

In case it helps:
Port 12080 is used by WebShield, Dwyco Video Conferencing, NetworkServer, Delta Three PC to Phone.

Trojan Troj/Agent-E, Win32.Disprox.A also use this port.

 

[Nas.CloudBusinessPortal]

In case it helps:
Port 12080 is used by WebShield, Dwyco Video Conferencing, NetworkServer, Delta Three PC to Phone.

Trojan Troj/Agent-E, Win32.Disprox.A also use this port.

and JMRI for controlling locomotives.