How can I tell who's FTPing into my computer?

Discussion in 'General Mac Discussion' started by Makosuke, Sep 20, 2004.

  1. Makosuke macrumors 603

    Joined:
    Aug 15, 2001
    Location:
    The Cool Part of CA, USA
    #1
    I'm wondering how I can tell who is connected to my computer (10.3) via FTP, and I haven't ben able to think of anything obvious so far. I assume the ftp daemon can tell me who's using it or something, but there didn't seem to be a man page I could read.

    It's a bit ironic, because I turned on the FTP server so somebody could grab a file off my computer, and although it seems to work fine, I realized I don't know how to check if he's actually connected or not.
     
  2. iMeowbot macrumors G3

    iMeowbot

    Joined:
    Aug 30, 2003
    #2
    There are two ways to see.

    From the terminal, cd /var/log and you will find ftp.log (the current one), plus ftp.log.?.gz which are archives. To look at the current log, use less /var/log/ftp.log.gz ; for the archives, use e.g. zcat /var/log/ftp.log.1.gz | less .

    If you prefer the GUI, you will find Console under Applications:Utilities. Click on the Logs icon, then the reveal triangle next to /var/log, and finally the ftp log files you are interested in.
     
  3. Makosuke thread starter macrumors 603

    Joined:
    Aug 15, 2001
    Location:
    The Cool Part of CA, USA
    #3
    Thank you much for the suggestion, iMeowbot; I'd actually looked at that log already (should have said so), and although it shows activity, it's kind of hard to tell whether somebody is actually connected right now from the log.

    I can see logins, and I can see logouts and timeouts, but since there seem to be multiple sequental logins showing (each time a WinXP user logs in, I see what looks like four connections in the log), it's not clear as to whether he's actually still logged in or not--does four logins minus two timeouts equal two still-active logins?
     
  4. bousozoku Moderator emeritus

    Joined:
    Jun 25, 2002
    Location:
    Gone but not forgotten.
    #4
    You could actually do it from the Terminal application by using a line like "netstat -an|grep "198.212.152.4.21" where 198.212.152.4 would be your own IP address and .21 is your FTP port. If the state is "ESTABLISHED", then there is an active connection.
     

Share This Page