Telnet - what IP address was destination

[Matt Pearse]

We would like to know what IP address a user telneted to so we can work out what package they are accessing

[hpuxrox]

Not completely sure what you are asking but try,

last -R

[MANOJ SRIVASTAVA · Accepted solution]

Hi Matt

You can possible look at lsof | grep the user name to know which Ip address the user is telnetting . lsof is a freware and works wonders and also ahs both 32 and 64 bit version available . You can look for it at

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/README

for the details.


Manoj Srivastava

[hpuxrox]

Also try,

netstat -a | grep telnet | grep username

[Jeff Schussele]

Hi Matt,

You could examine the user's history file - cat or more the file .sh_history in the user's home dir.

Or you could trying logging into this user's account on the system they were telnetting from and enter esc-k to see the last command entered & keep entering k to see previous commands.

Rgds,
Jeff

[Mark Greene_1]

who -u

HTH
mark

[harry d brown jr]

Matt,

Have each user create their own ".sh_history" file, by placing the following into /etc/profile

readonly HISTFILE="${HOME}/.sh_history_`date +%y%m%d.%H%M%S`.$$"
readonly HISTSIZE=50000
export HISTFILE HISTSIZE


Then do this, if their .sh_history's are in /home, otherwise change the /home to either / or the appropriate directory:

find / -type f -name ".sh_history*" -exec grep "telnet " {} \; | sed "s/\0//g" | grep "^telnet " | sort -u


THE "sed" for "\0" (NULL) allow s the further greps to work on SHELL HISTORY files.

live free or die
harry

[Matt Pearse]

Thanks to Manoj we have a solution.

lsof gives us the information we require.

Thanks
Matt