What IP-Address did a user connect to?

[BMW UNIX-Team W2]

So the connection to the virtual address is only during the logon-phase?

[George Morrison]

Let me add a new angle in here.

If the question is the IP address the user telneted to (e.g., a package IP address in a MC/SG cluster), one way is to use lsof to look at the telnetd process for that session. The telnetd process, started by inetd, has the stdin, stdout, and stderr connected the the socket. lsof will yeild details about the socket, including the IP address (see brief example attached).

You can also use pstat_getsocket to get the same information using C or getpeername if the program you are writing uses a socket that you want to find info on.

FYI, we wrote a program, getcpkg (get current package) that would get the IP addresses as described above and then match that to a package name.

Have fun!

[rick jones]

I'm going to guess that Exceed did an rlogin to the box and then launched some sort of nohupped xterm with DISPLAY pointed-back at your machine.

since the xterm is nohup, it is then "OK" for the rlogin/telnet session to be terminated and that is why the connection to the base IP is gone from netstat -an output - because the connection is no longer there.

this means you are left with only searching logs.

i suspect that if you simply popped-up a terminal emulator window and did a basic telnet to the package IP address you would still see that package IP address as the one in use.

as for how to get the xterm launched with a package IP as its source IP address... that would require either an option to xterm to have it bind() its socket combined with some scripting to find the IP address used for the rlogin session, or some creativity in applying the route(1m) command such that routes for specific destination IP addresses use specific package IP's