2

How do I check how many vnc connections or different users are currently connected to my machine? Only through wireshark? And how do I kill any other users connected through vnc?

Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
tux_drummer
  • 1,803
  • 5
  • 18
  • 14

4 Answers4

8

On Linux,

ss sport = :5900

Would tell you the currently established TCP connections on port 5900.

For anything else, we'd need to know what VNC server you're using as there exist dozens.

If you know the name of the VNC server command,

lsof -ai tcp -c that-command

(as the user running the VNC server or as root) would also tell you the currently established TCP connections handled by that VNC server (in case it's not on port 5900).

Among the methods to close a TCP connection in the general case, there's:

  • tcpkill (from dsniff package) that fakes the TCP packets that would close a connection.
  • iptstate (Linux). If you're using a statefull firewall. You can remove the connection from the Linux connection tracker table (x in iptstate), which would usually cause newer packets to be ignored (if the firewall is configured to only accept new connections with TCP SYN). It wouldn't kill the connection, just make it inactive though.
  • Add firewall rules to reject further packets transmitted/received in that connection (on Linux, iptables with target "REJECT", matching on source and destination TCP ports and IP addresses in OUTPUT and INPUT filter chains)
  • attach gdb to the running vnc server and do call close(fd) where fd is the file descriptor for the corresponding socket (which you've found out with lsof) followed by detach (it may confuse the vnc server a lot those, calling shutdown instead of close may be safer).
Stéphane Chazelas
  • 522,931
  • 91
  • 1,010
  • 1,501
0

Assuming your vnc server is Xvnc, try this one-liner:

lsof -Pni | grep Xvnc | grep -v LISTEN

This will list active connections and show you their process PID and IP addresses.

Raphael Ahrens
  • 9,701
  • 5
  • 37
  • 52
Jeremy
  • 1
0

According to this article the following command will show connections to processes containing "VNC command-line":

# sudo netstat -p | grep <name of VNC command-line>

Update

Please note that the netstat command has to run as root

HeatfanJohn
  • 1,285
  • 13
  • 17
0

I was looking for a similar command to figure out what port(s) I had vnc servers listening on and this is what I came up with.

ss -a -t '( dport >= :5900 & dport <= :5999 | sport >= :5900 & sport <= :5999 )'

See a longer explanation of the filter syntax and links to the source in the other answers/comments here.

dragon788
  • 812
  • 7
  • 14