Command to view the IP conected to my server.....

[Sebastian Perez]

Hi everyone!
I would like to know the hp-ux command to display de IP address from the other servers or pc that are conected to my server with any service sesion like ftp, telnet, etc. I try with #finger user_name but not appear the IP address conected just the port.
IS there any log file that keep this information__?? Thanks!

[Steven E. Protter · Accepted solution]

who -u will show all terminal connections.

who -u output


[1789#] who -u
root pts/0 Oct 10 01:16 15:05 4520 telaviv.investmenttool.com
root pts/1 Oct 10 18:08 . 8197 192.168.0.2

You should not use finger, its a security hazard. I recommend disabling it.

The rest of the information should come from netstat.

netstat -an is a good place to start, but netstat -in might give you better data.
netstat -gin also might server your need.

man netstat for more fun ways to get what you need.

SEP

[Jannik]

just another one, it will give the connecting machine and the date&time:
/usr/sbin/acct/fwtmp < /var/adm/wtmp > /var/tmp/wtmp.tmp

and then

more /var/tmp/wtmp.tmp

the file may be big :-)

[Jannik]

other commands as last or lastb may be usefull as well:
last # tells who has been logged on recently.
lastb # reports the recent unsuccessfull login attempts.

hope it helps.

[Sebastian Perez]

Thank you, both answer were very useful to me. Have a nice night.

[Tim Sanko]

If you want to do the IP tracking netstat -a will give you all the information you want, and then some...

Tim

[twang]

To show the login session:
# last |grep still
To show socket connection, you may take a look at output from:
# netstat -a

[Norman_21]

Hello,

last -R |pg (To show last remote connection)

netstat -in (is my favour one, it list the MTU as well but it's for different use than what you are looking for)!

[sysadm_1]

try this
who -u
netstat -an
last -R

[Steven Sim Kok Leong]

Hi,

I like to use the -f parameter in netstat before it filters out only the details you are looking for i.e. display remote IPs connected to your inet services:

# netstat -f inet

Sometimes, you might want to look for the exact process bound to a TCP or UDP port. In that case, you need to use lsof e.g. the following tells you which process/program is binding on tcp port 31770. Useful for identifying trojan backdoor binaries.

# lsof -i tcp:31770

Hope this helps. Regards.

Steven Sim Kok Leong

[Bill Hassell]

who -R is probably the most useful, but remember that there are MANY ways to connect besides telnet. You may have connections opened with remsh/rlogin, OpenSSH, programs that use client/server connections with sockets, web services, CIFS (Samba) and so on. SO a complete picture will need a tool like lsof (which does NOT come with HP-UX). You'll need to download this (very valuable) tool.

[Norman_21]

Hello,

Download the lsof tool from here. It's really valuable as Bill indicated.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.67/

thanks