Is any command to cheak network user ip.

[aamir4u]

Hello,

Is any command to cheak network user ip.which are access my server ports.

[akio_kabutogi]

Output of "who -u" or "netstat -an" will help ?

As I am not sure exactly what you mean by "user", my answer may not be addressing your question.

[aamir4u]

Hi,

I want to check network users ip.Which are access my server ports and access my application either is windows user or Linux users

what are they doing on network and what is her his IP addresses.

[akio_kabutogi]

Network ports are not always associated with "user" id/name on Linux or Window.

Whether or not each port is associated with a "user" depends on each application that uses its port.

If you think of application that is associated explicitly with a "user" - something like rlogin/telnet - then,

"who -u"  will do.

However, for other arbitrary applications, it's upto the application. This is because Transport and Network

layer (TCP and IP) protocol does not have any information over "user" information. It's supposed to be

the Session Layer (which comes above TCP protocol) that looks after "session" which can be associated

with "user". But even in that case where the application's session layer keeps track of its user, the meaning of "user" may not be the same as Linux user/Windows user. Any application can have its own "user" management

which can be dependent from Linux/Unix/Windows user management.

Therefore, I am afraid IP address information displayed by "netstat -an" would be the maximun you can get

if you think of heterogenious systems and applications. IP address is based on the common standard. Thus, any applications running over TCP/IP can have their own remote IP address, with which you can identify at least "the place" where the connection comes.

Hope this helps.

[aamir4u]

Thanks for help.

I have hp-ux server

many clients are access the application(Oracle,Apache) on that server

its connected on http,ssh,ftp etc.

I want to cheak how many clients are access my applications wether are network or public networks.

thanks. 

[akio_kabutogi · Accepted solution]

If you look at /etc/services, you can find which port number is used by each service

(like ssh, http, ftp etc).

You should first know which port numbers you want to check.

Then, try " netstat -an |awk '$4 ~ /nnnn$/' " , where "nnnn" is the port number you want to check.
For example ,

 $ netstat -an |awk '$4 ~ /1712$/'

tcp        0      0  10.111.22.33.1712     10.1.2.3.49253     ESTABLISHED
tcp        0      0  *.1712                 *.*                     LISTEN

ESTABLISHED means the user is currently using the application port 1712 from 10.1.2.3.

If you want to check all the application ports, then,

$ netstat -an |grep ESTABLISHED

will be enough ? Anyway, the right most number in "Local address" column stands for the port number.
By looking at the port number, you will know how many clients are accessing your server for that port

number.

[aamir4u]

Thanks Dear.

Thanks for great effort.