Summary: How to detect a user running a ftp job

From: Detlev Habicht (
Date: Wed Sep 09 1998 - 10:29:58 CDT

Hi all,

My question was:

  I have the problem, to detect a user, when he is running a special client,
  for example ftp. It is not possible for me to change the programs or to
  use something like a wrapper for the client. So i need something
  like snoop. But this tool must run the whole day (via cron for example)
  and has only to detect the special user and write this activity
  to a logfile or syslogd.

Perhaps my question wasn't very exact. I was looking for an easy to use
tool to catch packets in a network, analyze it and makes entrys for
syslog or and send mail under special conditions. Well, of course i
don't want to work very much to install such a tool.

I think i have to work. :-}

But i get some good hints.

A very good hint is Network Flight Recorder (NFR) at It is
free and may be a very good tool. When i have time i will test it.

Other hints are to use standard tools and make some scripts:

netstat -a:

This works on a UNIX box and is good to detect all connections and you can
see all used ports. But our problem is also using PCs.

snoop -d le0 -o /var/snoop.raw.out src myhost dst port 21:

This works also on a Sun. But our problem used also non standard ports.
So i have to check more than one port. But it is also possible to make
a script with this tool ...

Proxy server:

I get also the hint to use a proxy server. But we are at an university
and it is not possible to force the people here to use it ...


I think this works only for a server. But i have to check the clients.

Well, i think, to check the net means much work to have a useful tool
running in a good way. In former times i was using interman, etherman
and packetman from Nice tools,
but it is not possible to create alarms or thing like this.

Thanx to:

Shriman Gurung <>
Steve Kay <>
"Brian T. Wightman" <>
"Mark Sherman [ Y2k Consultant ]" <>
"Robert G. Ferrell" <>
Seth Rothenberg <>
Dave McFerren <>


 Detlev  | Institut fuer Mikroelektronische Systeme, Uni Hannover
 Habicht | D-30167 Hannover +49 511 7624992
 --------+-------- Handy    +49 172 5415752 ---------------------------

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:12:48 CDT