Monitoring TCP and UDP Port Events

You can use the TCPIP MONITOREVENTS command to

  • Monitor events happening on a specific port or range of ports. The port events monitored include OPEN, CLOSE, LISTEN, RESET (both LOCAL and REMOTE), UDP SEND, and UDP RECEIVE.

  • Dynamically add and remove ports being monitored.

  • Display the monitoring options that are currently being logged.

  • Specify the interval for logging monitored events.

  • Turn monitoring on and off.

The default for monitoring events is OFF.

The default logging interval is 3 minutes (180 seconds). The valid range you can specify is from 1 to 1800 seconds.

The following is a sample MONITOREVENTS response:

MONITORING UDP ON PORTS: NONE,
MONITORING TCP OPEN ON PORTS: 1 TO 1099, 1201 TO 65535,
MONITORING TCP LISTEN ON PORTS: 1 TO 1099, 1201 TO 65535,
MONITORING TCP RESET ON PORTS: 1 TO 1099, 1201 TO 65535,
MONITORING TCP CLOSE ON PORTS: 1 TO 1099, 1201 TO 65535,
LOG INTERVAL 180

Refer to the Networking Commands and Inquiries Help for additional information on the syntax and usage of this command.

Examples

Display the MONITOREVENTS status, which shows the ports that are being monitored for each of the monitored events. The log interval is also displayed.

NW TCPIP MONITOREVENTS

Enable monitoring of all ports for TCP and UDP events.

NW TCPIP MONEV + ALL

Disable monitoring of all ports for TCP and UDP events.

NW TCPIP MONEV - ALL

Disable monitoring on the specified ports for the OPEN event.

NW TCPIP MONEV - TCP OPEN 21, 100, 101, 1000 TO 2000

Disable monitoring on all ports for the LISTEN event.

NW TCPIP MONEV - TCP LISTEN

Disable monitoring on all ports except port 900 for the CLOSE and LISTEN events.

NW TCPIP MONEV - TCP CLOSE EXCEPT 900, - TCP LISTEN EXCEPT 900

Enable monitoring for the OPEN event for ports 400 through 500.

NW TCPIP MONEV + TCP OPEN 400 TO 500

Enable monitoring for the OPEN, LISTEN, RESET, and CLOSE events for ports 300 through 600.

NW TCPIP MONEV + TCP ALL 300 TO 600

Enable monitoring for the OPEN, LISTEN, RESET, and CLOSE events for all ports except 1100 through 1200.

NW TCPIP MONEV + TCP ALL EXCEPT 1100 TO 1200

Set the log interval to 180 seconds.

NW TCPIP MONEV LOG INTERVAL 180