Cfrtjryk

I need to create a service that logs all input on a certain port to a file. Do I have to create a custom program for this, or is there an already existing tool out there?

With help of IPtables and Syslog , we can logs all input on a certain port to a file.

IPtables default log file is /var/log/messages in RHEL based System and /var/log/syslog in Debian base system. we can log details to different log file.

Open your /etc/syslog.conf and Append following lines

kern.warning   /var/log/iptables.log

after adding , you have to restart syslog service to reflect changes using :

/etc/init.d/syslog restart

Now suppose you want to log port 80 , then just add below rule :

 iptables -A INPUT -p tcp --dport 80 -j LOG --log-level 4

Now just tail the logs and see

tail -f /var/log/iptables.log

To save rule :

/etc/init.d/iptables save

and enable required services at Start-up

chkconfig --level 35 iptables on

chkconfig --level 35 syslog on

There are a few tools out there but one of the most common is rsyslog. It's almost undoubtedly available in your distribution's package repository or you could of course build it from source.

The daemon usually listens on port 514 UDP and accepts UDP packets which are then put into specific log files based on rulesets specified in your rsyslog configuration.

It think also tcpdump could be handy here. (It is not limited to TCP)