I want to view if any SCP connections are coming to my Linux machine. How can I view those?
-
Is it sufficient to view any incoming ssh connection, or do you need to distinguish scp from other types of ssh connections? Do you want to view current connections or view a log of past connections?– John1024Aug 13, 2014 at 6:19
-
I just want to check the current/ongoing SSH & SCP connections.– Stark07Aug 13, 2014 at 6:23
3 Answers
Yes you can check the incoming connections by using below command.
ps aux | grep scp
You can also check the IP by using below command. scp use ssh to transfer files.
netstat -plant | grep sshd
-
ps aux
wont help much for incoming connections. The second command is helpful tho. May 2, 2017 at 9:21
scp is using the ssh protocol, so any scp will also be logged in /var/log/secure as an ssh connection.
sudo grep sshd /var/log/secure |tail
or
journalctl /usr/sbin/sshd |tail
However, you will not distinguish this connection from a SSH session on the same account.
You can use tcpdump -lnXvv dst port 22
.
as root user.
Following is a sample output:
15:52:01.257950 IP (tos 0x0, ttl 127, id 7254, offset 0, flags [DF], proto TCP (6), length 656)
172.17.27.130.52032 > 172.17.17.28.22: Flags [P.], cksum 0x9d77 (correct), seq 35152848:35153464, ack 16709, win 256, length 616
0x0000: 4500 0290 1c56 4000 7f06 5851 ac11 1b82 [email protected]....
0x0010: ac11 111c cb40 0016 4215 fe37 405f 5a61 [email protected]@_Za
0x0020: 5018 0100 9d77 0000 9a09 7a29 36ac 5c94 P....w....z)6.\.
0x0030: dee2 8679 e3b6 aef3 9096 aa53 1ea4 87c3 ...y.......S....
0x0040: 308b b034 b53d 14af 096e 20ad c2ff 81bc 0..4.=...n......
0x0050: 3ede 8035 1ad4 5d3f 9a19 9d60 a7a3 60ad >..5..]?...`..`.
This shows that a machine with IP 172.17.27.130 is sending data to 172.17.17.28.22 out of which 172.17.17.28 is dst host ip at port 22, which is for scp.