Mapping of IP to login name

[yc_2]

Hi,

From the netstat output, it displays the foreign IP addresses that connects to the host.

With this info, is there a way to find out who (ie. the login name) is login.


Thanks in advance,
YC

[Deepak Extross]

Try
who -T

[Vijeesh CTK]

hi

is the user telnet user.

then

who -u or who -T

CTK

[yc_2]

Hi,

The connect is through socket number (Client / Server application, not telnet).

who -T and who -u do not display the login name.


YC

[Michael Tully]

Hi,

# who -u
# who -T

The only downside of this that I see is that the output displays where there telnet session came from, not necessarily their own PC IP address or name.

e.g. My own IP address of my PC is say 10.20.20.25, but I was logged into another box first, before telnetting across to this one, so in fact it will show the IP or name of the server. 10.25.25.30

HTH
~Michael~

[kish_1]

Hi
Also you can edit following file add the option
export INETD_ARGS="-l" these will add all your connection information to syslog.

/etc/rc.config.d/netdaemons

[MANOJ SRIVASTAVA]

Hi Leong


May be you will like to look at lsof , this lists the active connections , port etc etc

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/README

download the binary and you are good to go . It will list the port with the user name connection etc .


Manoj Srivastava

[Michael Tully]

Hi,

If the ftp sire doesn't work try from here:

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.61/

[Steven Sim Kok Leong]

Hi,

If you are using SSH Communication's distribution of SSH, then you can find out the IP and user by reading from whoami and the SSH2_CLIENT value:

bash-2.05a$ echo `whoami` $SSH2_CLIENT
steven 1.2.3.4 4931 5.6.7.8 22

login=steven
source IP=1.2.3.4
source port=4931
dest IP=5.6.7.8
dest port=22

If you embed this command into /etc/profile and /etc/csh.login, then you can keep track of all SSH logins e.g.

echo `whoami` $SSH_CLIENT >> /var/adm/syslog/ssh.log

Hope this helps. Regards.

Steven Sim Kok Leong