Discover PC ip address via putty when connected to HPUX server

[eric lipede_1]

Hi
does anyone now how to discover the IP address of the PC via a putty session.

fyi
who -Rmut shows the ip address of the server
lsof -i4 -n | grep .12.175 shows sshd 17663 root 5u IPv4 0xe0004562f53740 0t820190 TCP 10.171.30.133:22->10.141.12.144:63015 (ESTABLISHED)
..I know 10.141.12.144 is my PC and I know 10.171.30.133 is the server in my garage but Id like to know if anyone can connect the out of say netstat/ lsof / who to derive the PC ip address. I used this particular example to highlight the fact that I already know the PC's IP address, I would simply like to find a way of extracting from the putty session.

For the record, "who -uH am i" also shows the server address and not the PC address.

thks

[eric lipede_1]

...Line should have read

lsof -i4 -n | grep .12.144 shows sshd 17663 root 5u IPv4 0xe0004562f53740 0t820190 TCP 10.171.30.133:22->10.141.12.144:63015 (ESTABLISHED)

[RickT_1]

Eric,

You can get the IP from the syslog.

Rick

[Viktor Balogh · Accepted solution]

Hi eric,

this is the proper way to do it:

# echo $SSH_CLIENT
172.17.22.20 1274 22
#

Regards,
Viktor

[eric lipede_1]

Hi

echo $SSH_CLIENT gives
10.171.30.133 59241 22...which is the server IP.
Re: syslog ...yes it features in the syslog but the question is how do you discover it via commands. In actual fact its in the results of many outputs and log files but Im trying to extract it from using commands. ...echo $SSH_CLIENT would have been great if it showed the PC ip (and Im sure it does in some cases). If it helps I have a dirty way of finding it via ..
let counter=0

ps -ef | grep `ps | grep -v TTY | sort -u -k2,1 | awk '{ print $2}'` | while read line
do
let NUM=`echo $line | awk '{ print $3 }'`

if [ $counter -eq 0 ]
then
let counter=counter+1
let LAST=$NUM
else
if [ $NUM -lt $LAST ]
then
let LAST=$NUM
fi
fi
done

if [ $NUM -lt $LAST ]
then
let LOWEST=$NUM
else
let LOWEST=$LAST
fi

ps -ef | grep "$LOWEST" | grep -v notty | grep -v grep | grep -v "@" | while read line
do
let var1=`echo $line | awk '{ print $2 }`
if
lsof -i -P | grep "$var1" | grep .com > /dev/null 2>&1
then
lsof -i -P | grep "$var1" | grep .com | awk '{ print $9 }'
fi
done


BUT its neither accurate or guaranteed to produce the correct result.

Please note I added it here merely to highlight what Im looking for ...not for a code critique as that would detract from the actual solution.

Thanks for far .......

[eric lipede_1]

... the output of the code above gives

garage_server:22->studypc1.okioc.com:63015
garage_server:22->studypc1.okioc.com:53551
garage_server:22->studypc2.okioc.com:3750

...again ...here ONLY to give an idea of where this should be going ...

[Viktor Balogh]

Getting it from syslog might be a good way, but if you are in a large enterprise environment, you should find your session. what is the output of

# echo $SSH_CONNECTION

? this will display both ip addresses, client and server, with the corresponding port numbers.

$SSH_CLIENT should also work, maybe you have opened an ssh session on your server and ssh'ed to localhost. You could check it with a clean start, opening a new connection with putty to your server...

[eric lipede_1]

Hi
ahh the joys of "should work".

Remember any good solution should be robust. As it happens, echo $SSH_CONNECTION
shows 10.171.30.133 59241 10.171.30.133 22.

Just to be clear..Im going in via WINSCP,then launching PUTTY.

....again, I stress that:
1. The information is not the mystery. You can get it from syslog, netstat (in a roundabout way), lsof etc.

2. Im looking for a solution that can be run from what ever terminal you choose.

Can we focus in on not what "can" be done, rather the actual question.

Ie. How do you get the IP address of the PC the terminal is connected to using the command tools available. If it isnt possible ..then ok but Im pretty sure there must be a way ...(theres a will after all !)
The dirty code above is a start...it shows my machine as well as another ...i suppose im looking for the "next correct step"

thks again in advance ...

[TwoProc]

$> who -a am i | awk '{print $8}'

or

$> echo $SSH_CLIENT | cut -f1 -d" "

[Bill Hassell]

Are you multi-hopping through several machines to get to this server? The server will report the nearest incoming system. You mentioned WinSCP to start PuTTY. Why aren't you starting the PuTTY session directly? Do you also have some Xwindows programs involved with these connections? Remember that xterm does not run on your PC -- it is stolen from the X server so if you then ssh to another machine, the incoming IP will not be your PC.

[eric lipede_1]

Hi

I purposely left out that I was multi-hopping. I wanted to see if anyone had gotten over that problem. Thanks for all the help. It would be great if a single putty sign-on was all the link there was. Ill leave the thread open for a few days to see if anyone cracks the route back to source for the IP....

[Bill Hassell]

I think it would have been more helpful to start with multi-hop. Since there are many ways to connect and no guarantee that the same protocol (telnet, ssh, rlogin, etc) will be used between hops, the only technique is to carry the originating IP with each hop. The only way I know how to do this is with telnet. There is a little known (but sometimes frustrating) option in telnet that carries the current value of TERM to the next destination. So you could do something like this:

TERM=10.11.12.13 telnet nexthop

You'll have to capture $TERM at the top of /etc/profile and save it off for the next hop.

Or run multiple single sessions. I can't tell you how many sysadmins accidentally shutdown the wrong server due to server hopping. I routinely have 5 to 10 PuTTY sessions, all with unique colors using either Connection Manager or Session Manager.

[Steven Schweda]

> I purposely left out [...]

Brilliant.

[eric lipede_1]

of course, the issue was finding a robust way of finding a solution (not tailored to a specific scenario).
Any good SA would and should know this. ..and I humbly accept your accolade ;-)