Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!usc!zaphod.mps.ohio-state.edu!mips!cs.uoregon.edu!ogicse!unmvax!uokmax!occrsh!att!watmath!watserv1!watcgl!watcgl!bmacinre
From: bmacinre@watcgl.uwaterloo.ca (Blair MacIntyre)
Newsgroups: comp.unix.ultrix
Subject: Something similar to netstat ... but quicker.
Message-ID: <1990Nov12.192712.23544@watcgl.waterloo.edu>
Date: 12 Nov 90 19:27:12 GMT
Sender: daemon@watcgl.waterloo.edu (Mr Background)
Distribution: comp
Organization: University of Waterloo
Lines: 23

If a specific host is connected to my machine, doing a finger, running
netstat gives the following lines in the output (something similar):
(I'm on watcgl, someone on seward.tn.cornell.edu is fingering me)

tcp        0      0  watcgl.finger          SEWARD.TN.CORNEL.2997  ESTABLISHED
tcp        0      0  watcgl.4788            SEWARD.TN.CORNEL.finge ESTABLISHED

To get this info, I have to run netstat (obviously), but this is
sloooow.

What I really want is to figure out if someone is currently doing a
remote finger on my machine AND where they are fingering from.  Is there
an easier way to do this?  I can get the fingerd process from ps but
don't see how to get where the socket connection that created it is
comming from.  What would be ideal is a flag for netstat that looks for
specific sorts of inetd connections and only prints out their sockets.

Anyway, I'm not really hopeful on this, but I would greatly appreciate
any help or hints or pointers as to which man page to RTFM! :-)
--
Blair MacIntyre, Computer Graphics Lab
Dept. of Computer Science, University of Waterloo, Waterloo, ON, Canada, N2L3G1
{bmacinre@watcgl|bmacintyre@{violet|watdragon}}.{waterloo.edu|uwaterloo.ca}