To determine the firewalls/interfaces from and to an AIX server

UNIX for Beginners Q & A
1

I wish to determine the various IP addresses that get connected to the AIX servers. It's like iptables of Linux. The idea here is that as we are moving to an alternate server (AIX), we need to be sure about the connections that need to be moved as well.

Can someone please help me with either a command that's equivalent of iptables of Linux in AIX? Or can someone please help me with a script to determine this or suggest an alternate way?

Gaya

2

It's not a super clear question, but you might consider:-

  • If it's user login, these would be recorded in the system logs - look in /etc/syslog.conf or /etc/rsyslog.conf for the files you write to.
  • If it's FTP or SFTP users, see above.
  • If you are looking for other services that report their activity such as a web-server on port 80, then again look in the relevant logs

If you want to see connections from anything connected when you look, you will get lots of output from something like netstat -na | grep ESTABLISHED however this does not show UDP connections and is only a report of connections at that instant.
If you want to see ALL connections whenever they are made, then you are probably looking at tcpdump, however that can generate vast amounts of traffic. It may be sensible to have a look at the output from netstat -na|grep LISTEN and decide which of the ports listed you want to watch traffic from. Tools such as Wireshark (formerly Ethereal) can help with interpreting the data recorded. If you fire up tcpdump, write it to a file and look at one port at a time to keep the data collected to a manageable size.

When moving to a new server, will it have a new DNS record and a new IP address? Depending how things connect, then you might be able to just create/alter CNAME records in the DNS to re-route the traffic.

Sorry that this might not help much, but it's a little difficult to exactly understand your need.

I hope that this helps,
Robin

1 Like