connection

cellranking · 04-20-2017, 12:50 PM

Hi Room

I want to see my ssh connection from port 22. below command give current now but I want to check past 5 minutes or may be longer time frame.

thank you

netstat -tn 2>/dev/null | grep :22 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

Turbocapitalist · 04-20-2017, 01:21 PM

The script you show has nothing to do with port 22.

Can you explain in a little more detail which information you are trying to collect? In all likelihood you will have to set up something explicitly to monitor the connections since netstat does not work retroactively.

cellranking · 04-20-2017, 01:31 PM

I just want to see from A time frame to B time frame has any connection from port 22.

Turbocapitalist · 04-20-2017, 01:45 PM

From or to port 22?

If you want to log the duration of the SSH connections, you could use xinetd to launch sshd instead of daemonized. It is one of the configuration options, specifically DURATION. See the manual pages for xinetd.conf and xinetd and sshd. The SSH daemon will need the -i option if you go that route.

Or else you could use tcpdump to try to catch the start and end packets for the various connections.