Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using lsof -i I can see there is a reverse ssh tunnel set up on my server:

sshd       1321   remote    8u  IPv4 219299       TCP localhost.localdomain:mvs-capacity (LISTEN)

How can I find out the IP address of the machine that created this tunnel?


share|improve this question

lsof -nPp 1321

share|improve this answer

Run lsof -i | grep 1321 to see the other connections the pid has, one of which should be the ip of the machine that created the tunnel.

share|improve this answer

or you can use netstat -a

share|improve this answer

Try netstat -ntp | grep 1321 (replace 1321 with the pid of the process in question.). This will allow you to see the network connections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.