topic Re: Telnet - what IP address was destination in Operating System - HP-UX

Telnet - what IP address was destination

Matt Pearse — Wed, 01 May 2002 13:52:12 GMT

We would like to know what IP address a user telneted to so we can work out what package they are accessing

Re: Telnet - what IP address was destination

hpuxrox — Wed, 01 May 2002 13:55:08 GMT

Not completely sure what you are asking but try,

last -R

Re: Telnet - what IP address was destination

MANOJ SRIVASTAVA — Wed, 01 May 2002 13:57:48 GMT

Hi Matt

You can possible look at lsof | grep the user name to know which Ip address the user is telnetting . lsof is a freware and works wonders and also ahs both 32 and 64 bit version available . You can look for it at

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/README

for the details.

Manoj Srivastava

Re: Telnet - what IP address was destination

hpuxrox — Wed, 01 May 2002 13:59:20 GMT

Also try,

netstat -a | grep telnet | grep username

Re: Telnet - what IP address was destination

Jeff Schussele — Wed, 01 May 2002 14:07:17 GMT

Hi Matt,

You could examine the user's history file - cat or more the file .sh_history in the user's home dir.

Or you could trying logging into this user's account on the system they were telnetting from and enter esc-k to see the last command entered & keep entering k to see previous commands.

Rgds,
Jeff

Re: Telnet - what IP address was destination

Mark Greene_1 — Wed, 01 May 2002 14:13:30 GMT

who -u

HTH
mark

Re: Telnet - what IP address was destination

harry d brown jr — Wed, 01 May 2002 14:21:44 GMT

Matt,

Have each user create their own ".sh_history" file, by placing the following into /etc/profile

readonly HISTFILE="${HOME}/.sh_history_`date +%y%m%d.%H%M%S`.$$"
readonly HISTSIZE=50000
export HISTFILE HISTSIZE

Then do this, if their .sh_history's are in /home, otherwise change the /home to either / or the appropriate directory:

find / -type f -name ".sh_history*" -exec grep "telnet " {} \; | sed "s/\0//g" | grep "^telnet " | sort -u

THE "sed" for "\0" (NULL) allow s the further greps to work on SHELL HISTORY files.

live free or die
harry

Re: Telnet - what IP address was destination

Matt Pearse — Wed, 01 May 2002 14:28:37 GMT

Thanks to Manoj we have a solution.

lsof gives us the information we require.

Thanks
Matt