How can I tell who's FTPing into my computer?

[Makosuke]

I'm wondering how I can tell who is connected to my computer (10.3) via FTP, and I haven't ben able to think of anything obvious so far. I assume the ftp daemon can tell me who's using it or something, but there didn't seem to be a man page I could read.

It's a bit ironic, because I turned on the FTP server so somebody could grab a file off my computer, and although it seems to work fine, I realized I don't know how to check if he's actually connected or not.

 

[iMeowbot]

There are two ways to see.

From the terminal, cd /var/log and you will find ftp.log (the current one), plus ftp.log.?.gz which are archives. To look at the current log, use less /var/log/ftp.log.gz ; for the archives, use e.g. zcat /var/log/ftp.log.1.gz | less .

If you prefer the GUI, you will find Console under Applications:Utilities. Click on the Logs icon, then the reveal triangle next to /var/log, and finally the ftp log files you are interested in.

 

[Makosuke]

Thank you much for the suggestion, iMeowbot; I'd actually looked at that log already (should have said so), and although it shows activity, it's kind of hard to tell whether somebody is actually connected right now from the log.

I can see logins, and I can see logouts and timeouts, but since there seem to be multiple sequental logins showing (each time a WinXP user logs in, I see what looks like four connections in the log), it's not clear as to whether he's actually still logged in or not--does four logins minus two timeouts equal two still-active logins?

 

[bousozoku]

You could actually do it from the Terminal application by using a line like "netstat -an|grep "198.212.152.4.21" where 198.212.152.4 would be your own IP address and .21 is your FTP port. If the state is "ESTABLISHED", then there is an active connection.