LSOF connection established

linux lsof
Mike picture Mike · Jun 12, 2009 · Viewed 7.6k times · Source

I was wondering, if the output of 

lsof -i 

sshd      21880     root    3r  IPv4 4843515       TCP somehost.lu.isp.com:ssh->d-XX-XXX.ITS.SOMEWHERE.COM:45037 (ESTABLISHED)
sshd      21882     mike    3u  IPv4 4843515       TCP somehost.lu.isp.com:ssh->d-XX-XXX.ITS.SOMEWHERE.COM:45037 (ESTABLISHED)
sshd      23853     root    3u  IPv6  960417       TCP *:ssh (LISTEN)
sshd      23853     root    4u  IPv4  960419       TCP *:ssh (LISTEN)
sshd      24043     root    3r  IPv4 4871654       TCP somehost.lu.isp.com:ssh->XXX.XX.XXX.XXX:42104 (ESTABLISHED)
sshd      24044     sshd    3u  IPv4 4871654       TCP somehost.lu.isp.com:ssh->XXX.XX.XXX.XXX:42104 (ESTABLISHED)

Does that imply that somebody has logged in on the system and is currently doing something? or means it's just trying to log in? I'm not quite sure about it.

Any clues? Thanks

Answer

AvatarOfChronos picture AvatarOfChronos · Jun 12, 2009

According to this

lsof -i only shows you active tcp connections. So it doesn't tell you if there logged in or still attempting to authenticate.

if you want to check to see who's logged in and from where you can run the "who" command. which will give you a list of the users logged in and where there logged in from (e.g. ssh, tty, etc)

Related questions

Seeing too many lsof can't identify protocol

I have a Java process/app. When I run /usr/sbin/lsof -p on that java process, I see a lot of "can't identify protocol". Also, interestingly, File descriptors(FDs) are increasing at a very steady rate. And those FDs …

Read More
"lsof" shows a file as (deleted) but I can still see it in file system

in Linux 2.6.27: From "lsof" output I see a process holding open fd with a (deleted) file. The strange thing is that I can still see the file in the file system using "ls". Why is that? thanks.

Read More
How many open files for each process running for a specific user in Linux

Running Apache and Jboss on Linux, sometimes my server halts unexpectedly saying that the problem was Too Many Open Files. I know that we might set a higher limit for nproc and nofile at /etc/security/limits.conf to fix …

Read More