How to find the IP of the source of an SSH reverse tunnel?

Question

Using lsof -i I can see there is a reverse ssh tunnel set up on my server:

sshd       1321   remote    8u  IPv4 219299       TCP localhost.localdomain:mvs-capacity (LISTEN)

How can I find out the IP address of the machine that created this tunnel?

Thanks

Answer 1

lsof -nPp 1321

Answer 2

Run lsof -i | grep 1321 to see the other connections the pid has, one of which should be the ip of the machine that created the tunnel.

Answer 3

or you can use netstat -a

Answer 4

Try netstat -ntp | grep 1321 (replace 1321 with the pid of the process in question.). This will allow you to see the network connections.

Answer 5

To get only the ip address you can do this.

netstat -ntp | grep "27750" | awk '{print $5}' | awk -F ':' '{print $1}'

If you know that you only have one tunnel you can use this without knowledge of the pid.

netstat -ntp | grep "sshd: root" | awk '{print $5}' | awk -F ':' '{print $1}'