🚀 go-pugleaf

Your Name (Yourname@somwhere.COM) wrote:
: Hiya all,

: I'm doing some programming under Unix (mainly ICL NX 7, SVR4) and BSD.

: If I log into the Unix machine from a PC running a telnet session, how 
: can I find the TCP address of the PC (either using shell script or C). 
: Finger will only give the telnet login location if known.

: Netstat will translate socket numbers into address, then where can I find 
: the socket that I'm using?????

Okay using netstat, you can do the following:

  % netstat -a | grep PC_MACHINE_NAME

The output will give you a line that basically says the following:

tcp  0   0  unix_name.telnet       PC_NAME.PORT      ESTABLISHED

Telnet is a well known and defined port (found in /etc/services) and should
be port 23 on all machines.  There are options on netstat that will do away
with the symbolic names and just print the IP address if you're interested.


: Thanks,

: here's a quicky...

: Does anyone know how to dynamically allocate sockets/ports to a unix 
: program, so that the next free socket will be used, rather than 
: specifying a socket??

The generalized socket () data structure, sockaddr_in (defined in 
/usr/include/netinet/in.h), that has a field sin_port.  This is where you
would specify a hard coded port number.  I believe (its been a while since
I did any of this) that if you specify 0 (zero), then it selects the next
available port ...

: Thanks again.


: Mat Maher
: Technical Manager
: Arete Software Ltd
: Milbanke Court,
: Bracknell, RG12 1RP
: UK.

: (+44) 01344 867706

jerry
--
Jerry Heyman                               | jerry@arlut.utexas.edu        O-
Combat System Simulation                   | http://www.arlut.utexas.edu/~jerry
Applied Research Laboratories of UT Austin | "Software is the difference
P.O. Box 8029, Austin, TX 78713-8029       |     between hardware and reality"

In article <846254378.24798.0@arete.demon.co.uk> Yourname@somwhere.COM (Your Name) writes:
>...
>
>If I log into the Unix machine from a PC running a telnet session, how 
>can I find the TCP address of the PC (either using shell script or C). 
>Finger will only give the telnet login location if known.
>
>...

Lsof will do this with several different selections:

*  lsof -i @<host_name>

   Will report all sockets with a local or foreign address that matches
   <host_name>, including the local and foreign port numbers used.

*  lsof -c telnetd

   Will report all files open to all processes running the telnetd
   command.

*  lsof -c telnetd -a -i @<host_name>

   Will restrict output to socket files having <host_name> as a
   local or foreign host address and whose command name is telnetd.

Normally lsof does Internet address to host name and port number
to service name conversions in its output, but that can be suppressed
with lsof options.

Lsof is available at:

	ftp://vic.cc.purdue.edu/pub/tools/unix/lsof

It's also available at many mirror sites.  You can find a mirror
site list at the indicated URL.

Vic Abell <abe@purdue.edu>

dbin@sce.de (David Binette) writes:

>Fine, i picked up lsof, its a well produced package with a good eye to
>security.

>Butwhat i really want to do is to find the IP address or name for the
> originator of a process...
>say for example a user is running process 16502 and i want to know the IP
> address of the rlogin/telnet/ftp/rexec/whatever that it comes from.

>does anyboddy have a non-perl solution for this?

Read the 00QUICKSTART documentation that comes with lsof.  Section
9, "Deciphering the Remote Login Trail," gives examples for several
UNIX dialects on how to identify remotely originated connection
processes when you know the originating Internet address, then
using that information to identify other processes initiated by
the connection process.

Reversing that sequence will go from a known process to the Internet
address of the incoming connection process.

Here's an example from SCO Release 3.0, taking three lsof probes.
Of course, with a Perl script (or AWK, if you don't like Perl) this
could be done in one probe.

This probe locates the tty name for the process.

dipper: 4 = lsof -p 25947 -ad0
COMMAND     PID     USER   FD   TYPE     DEVICE   SIZE/OFF      INODE NAME
ksh       25947      abe    0u   CHR    58,   0      0t951        596 /dev/ttyp0

This probe locates the rlogind process that has the pseudo tty
analog of /dev/ttyp0 open.

dipper: 5 = lsof /dev/ptyp0
COMMAND     PID     USER   FD   TYPE     DEVICE   SIZE/OFF      INODE NAME
rlogind   25946     root    3u   CHR    59,   0     0t1329        564 /dev/ptyp0

This probe shows the standard input file (an Internet file) open
by the rlogind process, thus identifying the host name of origin.

dipper: 6 = lsof -p25946 -ai -ad0
COMMAND     PID     USER   FD   TYPE     DEVICE   SIZE/OFF      INODE NAME
rlogind   25946     root    0u  inet 0xf1394384          0        TCP dipper.cc.purdue.edu:login->vic.cc.purdue.edu:1023

A Perl or AWK script could be used to access all open files at once
with lsof, saving their relevant information, and then selecting
for display the same information given in the above three probes.

Other UNIX dialects may require slightly different strategies,
depending on how pseudo and real tty files are associated, but the
basic techniques as described in lsof's 00QUICKSTART and its reversal
as described here are essentially the same.

Vic Abell <abe@purdue.edu>