How to check which ports are tunneled?

[alfer]

Hi all!

I have a linux machine, that connects my internal network with internet. Users can connect from internet to restricted account with putty and open tunnels. They forward their local ports to computers in local network. So they can telnet from internet to local SCO-server in my local network or connect to VNC on Windows 98.

I would like to see which ports my users forward. The report like:
user - john
his local port - 5900
forwrded to - 192.168.1.99:5900

How can I see such information? Do You know any appropriet commands?

Any help and any hit will be veeery helpfull

Thanks!

 

[ericbrunson]

You'd have to examine open sockets. "lsof -i" is useful.

 

[warpzero]

If you are using linux as a firewall with the masquerading option you can do the following

ipchains -l -n -M


WarpZero Technologies

http://www.warpzero.com/

 

[marsd]

iptables -L -v -n is the cureall if they are actually forwarding via iptables which should be impossible if they are unprivileged users....ssh has a different mechanism,
and can be traced via lsof -i -n or netstat, etc..

 

[alfer]

Thanks for all replies.
I have found the "lsof -i" the best.

Thanks!