Asus AC 1200 - how to view connections made by one of the LAN IPs via SSH?

[Ovidiu Sopa]

hello everyone,

Can I somehow (netstat) view the connections made by one of the devices connected to my LAN?
I don't know what device is using the ip .246 and I was curious if I can find out by viewing the connections that device is making, ip or hostnames, urls ... anything without needing to go and take the fuses off, room by room to see when it's not responding to ping

My Network is quite big as I share it with my brother, alao my office and workshop are all on the same LAN... more than 30 devices connected

 

[RMerlin]

Try "netstat-nat" instead.

Also, track down devices by their MAC (an online OUI lookup will generally give you the manufacturer):

cat /proc/net/arp

 

[Ovidiu Sopa]

There vendor reported by Fing is AMPAK Technology, there are no open ports.

I will try netstat-nap and report back.

Thank you

 

[RMerlin]

When it's such weird manufacturers, most likely target will be a cheap IoT device (like a security camera, or a media streamer).

 

[Ovidiu Sopa]

Found something, weird that more devices connected to similar hostnes, is that a known service to you ?

Hmmm .. is that googles domain?

PS i'm on my mobile, not to easy to check everything

 

[ColinTaylor]

Found something, weird that more devices connected to similar hostnes, is that a known service to you ?

Hmmm .. is that googles domain?

PS i'm on my mobile, not to easy to check everything

It's Google. Could be safe browsing, chrome or Google talk.
https://support.google.com/faqs/answer/174717?hl=en

 

[Ovidiu Sopa]

I didn't knew about the netstat-nat command, thank's RMerlin !

this morning:

admin@RT-AC1200G+:/tmp/home/root# netstat-nat | grep 192.168.1.246
tcp 192.168.1.246:43032 wo-in-f188.1e100.net:5228 ESTABLISHED
tcp 192.168.1.246:36430 wl-in-f188.1e100.net:5228 ESTABLISHED
tcp 192.168.1.246:37805 bud02s23-in-f206.1e100.net:www ESTABLISHED​

this evening:
admin@RT-AC1200G+:/tmp/home/root# netstat-nat | grep 192.168.1.246
tcp 192.168.1.246:37819 bud02s23-in-f14.1e100.net:www ESTABLISHED
tcp 192.168.1.246:43032 wo-in-f188.1e100.net:5228 ESTABLISHED
tcp 192.168.1.246:36430 wl-in-f188.1e100.net:5228 ESTABLISHED


I made a "Home Dashboard" and one of the functions is monitoring my network, when a new device is found I get a notification on my phone, when a device that is set as a 24/7 device is offline for more than 10 minutes, again I get a notification. This device I'm telling about appeared in my network now about 2 months ago, but I ignored it for unknown reason now when I ask everyone in the house , nobody knows what it could be. .... Untill today, it was an mediaplayer that my brother changed from Wifi to Wired, or the other way around, and this is why it showed up as new, as it did had a different MAC address

So .. problem solved

Thanks again for the tips.