topic Re: Tracking TCPIP SHOW DEVICE_SOCKETS to specific session in Operating System - OpenVMS

Tracking TCPIP SHOW DEVICE_SOCKETS to specific session

Richard W Hunt — Tue, 30 Sep 2003 07:22:10 GMT

Our security folks sometimes get a little crazy about TCP/IP security. They want to be able to trace a port number to a specific user and process. Unfortunately, what you get from the TCPIP SHOW DEVICE_SOCKETS command is BG devices, but what I REALLY want is to be able to tie the BG devices back to the corresponding TNA (pseudo-terminal) devices linked to and fed by the BGs.

The problem is that TNA devices have owners. BG devices, despite being active devices, do not. (Do a SHOW DEVICE/FULL TNA and compare it to a SHOW DEVICE/FULL BG to see the differences between the two.)

Short of writing privileged code to track an address chain through the device database, a prospect that doesn't enthrall me, is there a command that lets me track this linkage from a command-line prompt?

Re: Tracking TCPIP SHOW DEVICE_SOCKETS to specific session

Åge Rønning — Tue, 30 Sep 2003 08:02:57 GMT

The port number you see when typing "show us/f" should correspond to the port you get in TCPIP SHOW DEV if I remember correctly.

Re: Tracking TCPIP SHOW DEVICE_SOCKETS to specific session

Willem Grooters — Tue, 30 Sep 2003 09:28:35 GMT

It requires a number of lists:

$ SHOW DEV/FULL TNA - gives owning process data (name, Id, account) for each TNA device.

$ SHOW PROCESS/ID=
This will give you terminalnumber, remote host and portnumber for this process

$ TCPIP SHO DEV/FULL
search this list for remote host and port - and you'll have the BG device as well.

See attachment for an example.

Re: Tracking TCPIP SHOW DEVICE_SOCKETS to specific session

Antoniov. — Tue, 30 Sep 2003 09:56:54 GMT

Look this example:
$ SAY="WRITE SYS$OUTPUT"
$ A = 0
$MLOOP:
$ PN=F$PID(A)
$ IF PN .EQS. "" THEN GOTO END_LOOP
$ PPID :== 'PN'
$! Only interactive user
$ MODE=F$GETJPI(PPID,"MODE")
$ IF MODE.NES."INTERACTIVE" THEN GOTO MLOOP
$! Only telnet session
$ VT=F$GETJPI(PPID,"TERMINAL")
$ IF VT.EQS."" THEN GOTO MLOOP
$ IF F$EXTR(0,3,VT).NES."TNA" THEN GOTO MLOP
$ REMOTE=F$GETDVI(VT,"TT_ACCPORNAM")
$ REM_IP=F$ELEM(1," ",F$EDIT -(REMOTE,"COMPRESS"))
$! Now display Proc.ID, Terminal and Remote data
$ SAY PPID," ",VT," ",REMOTE," ",REM_IP,"!"
$ GOTO MLOOP
$END_LOOP:
$ EXIT
This is only an example. This command procedure don't work id you have define PC as host (TCPIP DEF HOST ...)

Bye
Antoniov

Re: Tracking TCPIP SHOW DEVICE_SOCKETS to specific session

Ian Miller. — Tue, 30 Sep 2003 11:46:32 GMT

As has been said several commands are required. The procedure I use can be found here
http://dcl.openvms.org/stories.php?story=03/06/03/0226504

Re: Tracking TCPIP SHOW DEVICE_SOCKETS to specific session

Ferriere Jean-Philippe — Fri, 14 Nov 2003 02:11:09 GMT

hi Antoniov,

it will work better with

$ IF F$EXTR(0,3,VT).NES."TNA" THEN GOTO MLOOP

and

$ REM_IP=F$ELEM(1," ",F$EDIT(REMOTE,"COMPRESS"))

:P

just my 2 cents