Linux Networking Tools & Log Management

Inspecting Network State with ss

ss (socket statistics) replaced the older netstat on modern distros — it reads directly from /proc/net, which makes it noticeably faster on busy hosts.

ss -tulpn is a security analyst's most common one-liner: every listening TCP/UDP socket, numeric, with the owning process.

netstat vs ss

netstat still exists on many systems for compatibility, but ss is the actively maintained, faster tool that most current documentation and tooling assumes.

Packet Capture with tcpdump

• tcpdump -i eth0 — capture on a specific interface
• -n — don't resolve hostnames, -c 20 — capture only 20 packets and stop
• Filter expressions: tcpdump port 443, tcpdump host 10.0.0.5 and port 22

Security use case: spotting unexpected outbound connections, or plaintext credentials traversing an unencrypted protocol. Running tcpdump on a busy interface without a filter mainly produces an overwhelming volume of irrelevant traffic — always scope the capture.

syslog and rsyslog

Traditional Linux logging models every message with a facility (what subsystem generated it: auth, cron, daemon, kern, user, ...) and a severity (0 emerg through 7 debug). /etc/rsyslog.conf routes messages based on these two fields, e.g. auth,authpriv.* /var/log/auth.log.

Where distros put logs differs slightly: Debian/Ubuntu conventionally use /var/log/syslog, while RHEL/Fedora use /var/log/messages. Authentication events land in /var/log/auth.log on Debian-family systems either way.

journald and journalctl (systemd-based logging)

• journalctl -u <service> — logs for one unit
• journalctl -f — follow new entries live, like tail -f
• journalctl --since "1 hour ago" — time-range filter
• journalctl -p err — priority filter (errors and worse)
• journalctl -k — kernel ring-buffer messages only

Depending on distro configuration, journald either complements rsyslog or replaces it outright.

Log Rotation with logrotate

Without rotation, a busy application's log grows without bound until it fills the disk. A typical /etc/logrotate.d/<app> entry:

/var/log/myapp/*.log {
    daily
    rotate 7
    compress
    missingok
    notifempty
}

daily + rotate 7 keeps a week of history, one file per day; compress gzips the older files to save space; missingok/notifempty avoid errors on quiet logs.

Common Pitfalls

• Running tcpdump with no filter on a production interface — you get everything and find nothing
• Treating journald as permanent storage when it's frequently volatile or size-capped by default, unlike a dedicated log-shipping/SIEM pipeline
• Forgetting logrotate on a custom application log and discovering the hard way when the disk fills up