Re: w, who, finger, last, and netstat and ipv6

[Andy Smith]

Hi Michael,

On Sun, Jul 24, 2016 at 12:08:34AM +0100, Michael Grant wrote:
> > > % who
> > > mgrant   pts/12016-07-18 06:15 (2a00:S.1)
> >
> > I type "who" on Debian jessie and I do get the full IPv6 address:
> >
> > $ who
> > andy pts/62016-07-23 01:42 (2001:ba8:1f1:f019::2)

[…]

> How odd that you are getting completely different results from me.

I've just noticed the :S.1 at the end of your output. That means
you're running from within GNU Screen. I get the same sort of
truncation when doing "who" from within GNU Screen so that probably
answers that.

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

Re: w, who, finger, last, and netstat and ipv6

[Michael Grant]

I just figured out what is going on.  The problem is gnu screen.

It's screen that's truncating the address.  When login and don't reattach
to my screen, I get the full address and "PROCPS_FROMLEN=40 w" prints the
expected full address.

Re: w, who, finger, last, and netstat and ipv6

[Michael Grant]

>
>
>
> > % who
> > mgrant   pts/12016-07-18 06:15 (2a00:S.1)
>
> I type "who" on Debian jessie and I do get the full IPv6 address:
>
> $ who
> andy pts/62016-07-23 01:42 (2001:ba8:1f1:f019::2)
> $ who --version
> who (GNU coreutils) 8.23
> Copyright (C) 2014 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later <
> http://gnu.org/licenses/gpl.html>.
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law.
>
> Written by Joseph Arceneaux, David MacKenzie, and Michael Stone.
>

I'm running Debian Testing

% who --version
who (GNU coreutils) 8.25
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later .
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Joseph Arceneaux, David MacKenzie, and Michael Stone.

How odd that you are getting completely different results from me.  I tried
setting PROCPS_FROMLEN and it indeed makes the field wider but it's all
blank padded out, this does not make the address any longer.

I feel maybe I have some conflicting lib installed somehow that's messing
up the representation of these addresses.  I did not back out this version
and install 8.23.


>
> Using the "-a" option to put the hostname/IP at the end does allow
> it to be of arbitrary length:
>
> $ last -a
> andy pts/6Sat Jul 23 01:42   still logged in
> 2001:ba8:1f1:f019::2


last -a and netstat --wide do help, thanks for that!

Re: w, who, finger, last, and netstat and ipv6

[Andy Smith]

On Sat, Jul 23, 2016 at 01:53:07AM +, Andy Smith wrote:
> On Fri, Jul 22, 2016 at 11:57:32PM +0100, Michael Grant wrote:
> > netstat does a little better still but not much:
> > 
> > tcp6   0   2640 2600:3c00:::9:22 2a00:23c4:6d10:4d:36663
> > ESTABLISHED 12345/sshd: mgrant
> 
> "--wide" works for me.
> 
> $ netstat --protocol inet6 --wide
> Active Internet connections (w/o servers)
> Proto Recv-Q Send-Q Local Address   Foreign Address State 
>  
> tcp6   0164 2001:ba8:1f1:f02c::2:ssh bitfolk.com:60756   
> ESTABLISHED

Oh, that is showing the local host's own v6 address, not the place I
was coming from. Add "--numeric-hosts" to get that. It isn't
truncated for me as long as I use "--wide".

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

Re: w, who, finger, last, and netstat and ipv6

[Andy Smith]

Hi Michael,

On Fri, Jul 22, 2016 at 11:57:32PM +0100, Michael Grant wrote:
> Why is it w, who, and finger truncate an ipv6 address just after the first
> 4 characters of the address (the first :)?

It isn't a great answer but I'm guessing the honest one is that it's
because they come from a time before IPv6 and may not have been
updated in the best way since then.

> % who
> mgrant   pts/12016-07-18 06:15 (2a00:S.1)

I type "who" on Debian jessie and I do get the full IPv6 address:

$ who
andy pts/62016-07-23 01:42 (2001:ba8:1f1:f019::2)
$ who --version
who (GNU coreutils) 8.23
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later .
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Joseph Arceneaux, David MacKenzie, and Michael Stone.

> % w
>  18:37:31 up 4 days, 12:26,  4 users,  load average: 0.05, 0.07, 0.05
> USER TTY  FROM LOGIN@   IDLE   JCPU   PCPU WHAT
> mgrant   pts/12a00:S.1 Mon064days  0.02s  0.02s /bin/bash

Using the PROCPS_FROMLEN as documented in the man page, I can
increase the width of the "FROM" column:

$ PROCPS_FROMLEN=32 w
 01:46:09 up 97 days, 10:48,  6 users,  load average: 0.09, 0.08, 0.06
USER TTY  FROM LOGIN@   IDLE   JCPU   PCPU 
WHAT
andy pts/62001:ba8:1f1:f019::2 01:420.00s  0.16s  0.00s 
w
$ w --version
w from procps-ng 3.3.9

> %  finger
> Login NameTty  Idle  Login Time   Office Office
> Phone
> mgrantMichael Grant   pts/1  4d  Jul 18 06:15 (2a00:S.1)

I don't have "finger" installed, so will leave investigation of that
one to someone else.

> The 'last' command does a little better, it truncates at 16 characters:
> 
> mgrant   pts/02a00:23c4:6d10:4 Fri Jul 22 18:04:00 2016   still
> logged in

Using the "-a" option to put the hostname/IP at the end does allow
it to be of arbitrary length:

$ last -a
andy pts/6Sat Jul 23 01:42   still logged in2001:ba8:1f1:f019::2

> 
> netstat does a little better still but not much:
> 
> tcp6   0   2640 2600:3c00:::9:22 2a00:23c4:6d10:4d:36663
> ESTABLISHED 12345/sshd: mgrant

"--wide" works for me.

$ netstat --protocol inet6 --wide
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address   Foreign Address State  
tcp6   0164 2001:ba8:1f1:f02c::2:ssh bitfolk.com:60756   ESTABLISHED

> This seems so basic.  Could all of these programs except tcpdump be broken
> with respect to displaying ipv6 addresses?

It didn't seem that hard to find this info from looking at the
relevant man pages…

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

w, who, finger, last, and netstat and ipv6

[Michael Grant]

Why is it w, who, and finger truncate an ipv6 address just after the first
4 characters of the address (the first :)?

% who
mgrant   pts/12016-07-18 06:15 (2a00:S.1)

% w
 18:37:31 up 4 days, 12:26,  4 users,  load average: 0.05, 0.07, 0.05
USER TTY  FROM LOGIN@   IDLE   JCPU   PCPU WHAT
mgrant   pts/12a00:S.1 Mon064days  0.02s  0.02s /bin/bash

%  finger
Login NameTty  Idle  Login Time   Office Office
Phone
mgrantMichael Grant   pts/1  4d  Jul 18 06:15 (2a00:S.1)


The 'last' command does a little better, it truncates at 16 characters:

mgrant   pts/02a00:23c4:6d10:4 Fri Jul 22 18:04:00 2016   still
logged in

netstat does a little better still but not much:

tcp6   0   2640 2600:3c00:::9:22 2a00:23c4:6d10:4d:36663
ESTABLISHED 12345/sshd: mgrant


It seems near impossible to find out what the ip address someone is logged
in from when they come in via ipv6.  tcpdump -n seems about the only way.

This seems so basic.  Could all of these programs except tcpdump be broken
with respect to displaying ipv6 addresses?


Michael Grant