16

In order to find out who was logged in recently on my server I am using the command:

There were logins from very strange IP addresses e.g.:

username@pc:/home/user$ last
username pts/16       59.224.XX.178.d Sun Aug  2 12:26 - 12:27  (00:00)

(where X was a number).

My question: What does the suffix .d mean? And why are these entries gone when I am using last with the option "-i"?

0

2 Answers 2

41

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it.

Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the hostname gets displayed and long ones get truncated to display nice columns.

Try last -a to display the hostname on the last column without truncation. or last -i to display the ip-address.

Compare:

$ last -n 1  name
name      pts/0        host38.resource. Mon Aug 17 15:46 - 16:00  (00:13)

$ last -n 1 -a name
name      pts/0        Mon Aug 17 15:46 - 16:00  (00:13)     host38.resource.hq.example.com

$ last -n 1 -i name
name      pts/0        10.9.8.38        Mon Aug 17 15:46 - 16:00  (00:13)
6

The -i makes 'last' show the remote hostname in dots and numbers IP address format instead of trying to display the hostname.

I am not sure what the '.d' suffix is, nor can I find out anything on google. I can only guess it is trying to do a reverse lookup and is giving you part of a hostname and truncating it, although i thought you must specify -d to do hostnames.

3
  • 1
    thanks a lot! i think it was the truncating of the reverse lookup!
    – Jimmy88
    Aug 17, 2015 at 15:00
  • 4
    In this case, I suspect that "d" is the first letter of either "dsl" or "dynamic". Hard to tell without knowing the exact IP, though.
    – user15323
    Aug 17, 2015 at 18:06
  • yes it was right, now have seen it thanks for your help!
    – Jimmy88
    Aug 18, 2015 at 8:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .