Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was checking out recent logins, and last -i showed logins from unfamiliar IP addresses. In checking what processes these logins were running, it became apparent that these logins were xterm windows that I initiated. Logins from a remote host via ssh showed the correct source IP address. I'm running openSuSE 11.1 and the icewm window manager. Any ideas why this is happening, and how I can avoid incorrect IP addresses? Thanks.

share|improve this question
Can you give examples of what you mean by 'incorrect'? – Michael Graff Dec 17 '09 at 21:05

We would need to see what these IPs are really. They could be local IPs which you would overwise may not be aware of before (e.g.

share|improve this answer

On my system last -i simply displays for non-remote logins.

share|improve this answer

Here's some output from last -i.

chuck    pts/5       Thu Dec 17 12:31   still logged in
chuck    pts/4      Thu Dec 17 10:20   still logged in  
chuck    pts/0       Wed May  6 11:19   still logged in   
chuck    pts/3      Thu Mar 19 13:20   still logged in   
chuck    pts/1      Thu Mar 19 13:20   still logged in

None of these are local IPs. Also, all of the incorrect IPs (there are more than the ones I show) end in .0. My local logins (into a tty as opposed to a pts) show a source of

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.