5

I want to view if any SCP connections are coming to my Linux machine. How can I view those?

2
  • Is it sufficient to view any incoming ssh connection, or do you need to distinguish scp from other types of ssh connections? Do you want to view current connections or view a log of past connections?
    – John1024
    Aug 13, 2014 at 6:19
  • I just want to check the current/ongoing SSH & SCP connections.
    – Stark07
    Aug 13, 2014 at 6:23

3 Answers 3

6

Yes you can check the incoming connections by using below command.

ps aux | grep scp

You can also check the IP by using below command. scp use ssh to transfer files.

netstat -plant | grep sshd
1
  • ps aux wont help much for incoming connections. The second command is helpful tho. May 2, 2017 at 9:21
3

scp is using the ssh protocol, so any scp will also be logged in /var/log/secure as an ssh connection.

sudo grep sshd /var/log/secure |tail 

or

journalctl /usr/sbin/sshd |tail

However, you will not distinguish this connection from a SSH session on the same account.

3

You can use tcpdump -lnXvv dst port 22. as root user.

Following is a sample output:

15:52:01.257950 IP (tos 0x0, ttl 127, id 7254, offset 0, flags [DF], proto TCP (6), length 656)
172.17.27.130.52032 > 172.17.17.28.22: Flags [P.], cksum 0x9d77 (correct), seq 35152848:35153464, ack 16709, win 256, length 616
0x0000:  4500 0290 1c56 4000 7f06 5851 ac11 1b82  [email protected]....
0x0010:  ac11 111c cb40 0016 4215 fe37 405f 5a61  [email protected]@_Za
0x0020:  5018 0100 9d77 0000 9a09 7a29 36ac 5c94  P....w....z)6.\.
0x0030:  dee2 8679 e3b6 aef3 9096 aa53 1ea4 87c3  ...y.......S....
0x0040:  308b b034 b53d 14af 096e 20ad c2ff 81bc  0..4.=...n......
0x0050:  3ede 8035 1ad4 5d3f 9a19 9d60 a7a3 60ad  >..5..]?...`..`.

This shows that a machine with IP 172.17.27.130 is sending data to 172.17.17.28.22 out of which 172.17.17.28 is dst host ip at port 22, which is for scp.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .