network-

[so_2]

Hi gurus,

Please answer for my following queries.
1.How can we get the ip address of remote machines accessing my hp ux server and what applications each ip is accessing.
2.is there any way to analyse the data frame coming in or going out of the server?
3.Or is there any way to find the mac address of the incoming requests..?
thanks in advance...
s.o

[Arunvijai_4 · Accepted solution]

Hi S.O,

1) You can do it by # who -T and # whodo commands

2) Use packet sniffers like TCPDUMP or Ethereal. Both are part of Internet express package http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

3) arp -a

-Arun

[so_2]

Hi Arun

your answeres are excellent. I would like to askone more doubt to you. who -T is giving ip address but how can i know that what port the request from these ip machines are accessing?
Hope you could give me the answer for this either..

Thanks again and assigning the points.

s.o

[Arunvijai_4]

Hi S.O,

To get the port details, you have use another tool, lsof

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.77/

Also, netstat -na |grep -E will give some details.

-Arun

[Peter Godron]

Hi,
you can also try the binary version from:
http://the-other.wiretapped.net/security/host-security/lsof/binaries/hpux/B.11.11/

[rick jones]

The "who" stuff will show users to actually login to the machine, but not necessarily those accessing via stuff other than telnet/rlogin/ssh.

The arp -a (or arp -an to avoid the DNS lookups) will only show MAC address for systems in the same local LAN segment and who are _NOT_ using a router to get to your system. If the client is on the other side of a router, you will either see the client's IP associated with the router's MAC if you are using Proxy ARP, or you will not see the client's IP/MAC in the arp output at all.

That same restriction would apply to tcpdump and/or ethereal - for remote clients, the MAC one will see will be the MAC of the router.