[bostik]

My current tool of choice for on-demand console traffic monitoring is tcptrack.[0] Uses libpcap so accepts the same filtering syntax as tcpdump.

It can be pretty CPU intensive, so I would recommend against running it on production perimeter systems. Also, the 2 second default retention period is a bit short.

But all in all very handy.

0: https://tracker.debian.org/pkg/tcptrack

[lsv1]

Thanks, I'll give this a try.