topic Trace IP address from PROCESS ID in Operating System - HP-UX

Trace IP address from PROCESS ID

Nitin Nigam — Mon, 29 Dec 2003 19:00:40 GMT

Hi

All the users are logging into the HP-Ux server using same username for certain process. Is it possible to trace back the IP address of the workstation using PROCESS ID or something else.

Please let me know if anyone has solution.

Thanks

Re: Trace IP address from PROCESS ID

I.Delic — Mon, 29 Dec 2003 19:28:59 GMT

Hi,

I suppose that your users get connection with an database on your UNIX box.
Can you use your database utility to look fot the connection ?

Can you give as more info over the proces that your users start.

Idriz

Re: Trace IP address from PROCESS ID

Rajeev Shukla — Mon, 29 Dec 2003 19:30:47 GMT

Yes it is possbile if you have lsof installed.
You can grep for the process for that login id and then run
/opt/lsof/bin/lsof -p $id | grep ESTABLISHED
for each PID ($ id is the process id)
you'll get the IP address or the host name connected to that process.

Re: Trace IP address from PROCESS ID

Steve Lewis — Tue, 30 Dec 2003 05:05:57 GMT

Shared accounts are bad for auditing and best avoided where possible. If the clients all connect through a middle tier application server, then you will not be able to find the IP from the server. If they connect direct to the HP-UX box, but all using the same account (why?) then try this alternative, all on one command line, substitute 'username' for the user you want to list.

$ /usr/bin/w username | awk '{c=sprintf("who -R | grep %s",$2);print $0;system(c)}' | awk '{printf("%s\t",$0);
getline;print $6}'

It uses the tty or pseudo tty as a grep search pattern in who -R for each matching line in /usr/bin/w.

Re: Trace IP address from PROCESS ID

Abdul Majeed Lardhi — Tue, 30 Dec 2003 06:09:32 GMT

if it is tty process, you can use

ps -ef
finger -R

it maight help

regards
A. Majeed