1. Overview
In this tutorial, we’ll review some scenarios of finding the client’s IP address while connected to an SSH session.
2. Introduction to the Problem
When connecting to a remote machine through an SSH session, there are times when we would like to find the IP of the client without disconnecting the session.
By closing the session, processes running in the background can be interrupted, or we could lose information —like the directory we’re working on or information stored in variables.
In the following scenarios, we’ll see how we can get the client IP address, from a remote session, without closing the session.
3. who and w Commands
The who command is a tool that parses the login database files (/var/run/utmp or /var/log/wtmp by default) and retrieve useful information about who’s logged on:
user1$ who
user1 pts/0 2020-12-25 05:19 (189.137.157.229)
ale pts/1 2020-12-25 05:20 (189.249.25.155)
...
Here, the client IP address is the last field of the registry.
Additionally, we can specify our user using the parameters am and i:
user1$ who am i
user1 pts/0 2020-12-25 05:19 (189.137.157.229)
The w command also parses the /var/run/utmp file to show who’s currently logged on, and the /proc file to see the processes associated with the user:
user1$ w
05:35:08 up 1450 days, 7:07, 1 user, load average: 0.00, 0.01, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
user1 pts/0 189.137.157.229 05:19 0.00s 0.03s 0.00s w
ale pts/1 189.249.25.155 05:20 0.00s 0.03s 0.00s -bash
...
In this scenario, the client IP address is in the third column.
4. finger and pinky Commands
The finger and pinky commands display similar information about the users logged on the system:
user1$ finger
Login Name Tty Idle Login Time Office Office Phone
user1 pts/0 Dec 25 06:04 (189.137.157.229)
user1$ pinky
Login Name TTY Idle When Where
user1 pts/0 2020-12-25 06:04 189.137.157.229
Using either of the two commands, we can see the client IP address in the last field.
5. last Command
The last command shows a listing of the last logged in users since the file was created by parsing the /var/log/wtmp file by default.
Let’s use this pipe the result of this command to the head command to get only the information of the last users logged on:
user1$ last | head
user1 pts/0 189.137.157.229 Fri Dec 25 06:29 still logged in
ale pts/1 189.249.25.155 Fri Dec 25 06:19 - 06:20 (00:00)
...
Here, we can see the client IP address in the third field.
6. netstat and ss Commands
netstat and ss are two very useful tools that retrieve information about the processes using sockets.
Let’s use netstat filtered by grep, to get the client IP addresses:
user1$ sudo netstat -tpn | grep "ESTABLISHED.*sshd"
tcp 0 60 10.128.0.2:22 189.137.157.229:18068 ESTABLISHED 29446/sshd: user1 [pr
...
Here, we see the client IP address in the 5th field in the format
Let’s take a closer look at the netstat parameters:
- -t lists only the sockets using the TCP protocol
- -p shows the process id and name of the program using the socket
- -n shows the addresses in a numerical way
The grep pattern allows us to filter only the processes using the sshd daemon with a connection established.
Let’s use ss in a similar way to netstat:
user1$ sudo ss -tp | grep "ESTAB.*sshd"
ESTAB 0 92 10.128.0.2:ssh 189.137.157.229:18068 users:(("sshd",pid=29863,fd=3),("sshd",pid=29861,fd=3))
...
Here, we can see the IP address in the 5th field in the format
Let’s take another look at the parameters used in the ss command:
- -t displays TCP sockets
- -p shows processes using socket
We’ve used the grep command to filter in the same way as in the netstat example.
Since netstat is deprecated, we should use the ss tool.
7. lsof Command
Another powerful tool is the lsof command. This command stands for “list open files”.
By using this program, we can get information about files open and the processes that are using them. Since a file can be a socket, we can use that to find out connection information:
user1$ sudo lsof -i TCP -s tcp:established -n | grep ssh
sshd 29448 user1 3u IPv4 63825743 0t0 TCP 10.128.0.2:22->189.137.157.229:18068 (ESTABLISHED)
...
Here, we can see the client IP address in the 9th field in the format
Now, let’s review the lsof parameters:
- -i TCP selects the files using the TCP protocol
- -s tcp:established lists only network files with “tcp” state “established”
- -n prevents lsof from translating network numbers to hostnames. By this, we can see the numeric IP address
8. Conclusion
In this tutorial, we’ve reviewed some strategies to get the client’s IP address while we’re in an SSH session.
We’ve used the who, w, finger, pinky, last, netstat, ss, and the lsof commands.