0

I am running ubuntu server 18.04 with nginx and php-fpm 7.2.

I have multiple domain names hosted on the same server.

How can i monitor the incoming traffic on all the websites on my server using terminal only.

I would like to have it list out in real time something like this:

http://example.com/path-1/
http://example.com/path-2/
http://example.com/path-3/

I have tried numerous available answers on this website, however none of them served the purpose.

Note that I do not want to read nginx or any logs, i want to monitor real time incoming traffic please.

Thank you.

Improve this question
1
  • Real time traffic will require packet inspection, and that'll require some advanced configuration. Slightly less realtime but still accurate would be to have NGINX pipe data to a syslog listener on something such as Splunk which will let you then run analysis on the logs to see all the requests in semi-realtime. Other option is a netflow server but that requires advanced configuration of your infrastructure to work right.
    – Thomas Ward ♦
    Feb 16, 2020 at 17:31

1 Answer 1

Reset to default
0

The requirements make this one difficult. A crude solution would be to use tcpdump (or wireshark, if preferred), to examine the network traffic directly:

$ sudo tcpdump -n -tttt -i br0 port 80 -A | grep -A 1 GET

Where br0 is my interface name (a bridge). I don't host multiple sites on that test server, but tested via it's name (s15) and ip address (192.168.111.112). The actual web page is just the default apache web page:

doug@s15:~$ sudo tcpdump -n -tttt -i br0 port 80 -A | grep -A 1 GET
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
2020-02-16 09:11:56.885246 IP 192.168.111.101.62720 > 192.168.111.112.80: Flags [P.], seq 1:481, ack 1, win 1026, length 480: HTTP: GET / HTTP/1.1
E...<.@...[...oe..op...P....J..)P.......GET / HTTP/1.1
Host: 192.168.111.112
--
2020-02-16 09:11:56.997078 IP 192.168.111.101.62720 > 192.168.111.112.80: Flags [P.], seq 481:920, ack 3526, win 1026, length 439: HTTP: GET /icons/ubuntu-logo.png HTTP/1.1
E...<.@...\...oe..op...P....J.$.P...._..GET /icons/ubuntu-logo.png HTTP/1.1
Host: 192.168.111.112
--
2020-02-16 09:12:25.021292 IP 192.168.111.101.62726 > 192.168.111.112.80: Flags [P.], seq 1:469, ack 1, win 8212, length 468: HTTP: GET / HTTP/1.1
E...<.@...[...oe..op...PC.1..L.CP. .H...GET / HTTP/1.1
Host: s15

You mentioned you didn't want to look at the logs, but that would be way easier:

doug@s15:~$ tail /var/log/apache2/access.log
192.168.111.101 - - [16/Feb/2020:09:05:05 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://s15/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:05:20 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:05:21 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 200 3623 "http://192.168.111.112/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:05:21 -0800] "GET /favicon.ico HTTP/1.1" 404 493 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:06:15 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:06:15 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://192.168.111.112/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:11:56 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:11:56 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://192.168.111.112/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:12:25 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:12:25 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://s15/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"

Of course, the simple GET string filtering the tcpdump output is prone to false triggering on that string being in the returned content.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .