Solved Get the IP address of all sshd connections.

[byrnejb]

I am looking for a reliable way of getting the IP origin of all pts sessions. The lastutility would be perfect other than it prints the host name and not the ip address. And I cannot see any way to force it to print the numeric address instead. Is there something similar that will?


A: I used netstat.

netstat -an | grep ESTABLISHED | grep '\.22 ' | \
      cut -w -f 5 | cut -d '.' -f 1-4 | \
      sort -u -V

 

[covacat]

UseDNS no in sshd_config may work (for IP utx logging)

 

[byrnejb]

Thanks. As it turns out the netstat output is easier to script with.

 

[Eric A. Borisch]

Check out sockstat(1), too.

sockstat -4 -c -p 22