LSOF连接已建立 [英] LSOF connection established

问题描述

我想知道

lsof -i 

sshd      21880     root    3r  IPv4 4843515       TCP somehost.lu.isp.com:ssh->d-XX-XXX.ITS.SOMEWHERE.COM:45037 (ESTABLISHED)
sshd      21882     mike    3u  IPv4 4843515       TCP somehost.lu.isp.com:ssh->d-XX-XXX.ITS.SOMEWHERE.COM:45037 (ESTABLISHED)
sshd      23853     root    3u  IPv6  960417       TCP *:ssh (LISTEN)
sshd      23853     root    4u  IPv4  960419       TCP *:ssh (LISTEN)
sshd      24043     root    3r  IPv4 4871654       TCP somehost.lu.isp.com:ssh->XXX.XX.XXX.XXX:42104 (ESTABLISHED)
sshd      24044     sshd    3u  IPv4 4871654       TCP somehost.lu.isp.com:ssh->XXX.XX.XXX.XXX:42104 (ESTABLISHED)

这是否意味着有人已经登录系统并且当前正在做某事?还是意味着它只是尝试登录?我不太确定.

Does that imply that somebody has logged in on the system and is currently doing something? or means it's just trying to log in? I'm not quite sure about it.

有任何线索吗?谢谢

推荐答案

根据this

lsof -i仅显示活动的tcp连接.因此，它不会告诉您是否已登录或仍在尝试进行身份验证.

lsof -i only shows you active tcp connections. So it doesn't tell you if there logged in or still attempting to authenticate.

如果要查看谁登录以及从哪里登录，可以运行谁"命令.这将为您提供登录用户的列表以及登录的位置(例如ssh，tty等)

if you want to check to see who's logged in and from where you can run the "who" command. which will give you a list of the users logged in and where there logged in from (e.g. ssh, tty, etc)

这篇关于LSOF连接已建立的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！