Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I check how many vnc connections or different users are currently connected to my machine? Only through wireshark? And how do I kill any other users connected through vnc?

share|improve this question

On Linux,

ss sport = :5900

Would tell you the currently established TCP connections on port 5900.

For anything else, we'd need to know what VNC server you're using as there exist dozens.

If you know the name of the VNC server command,

lsof -ai tcp -c that-command

(as the user running the VNC server or as root) would also tell you the currently established TCP connections handled by that VNC server (in case it's not on port 5900).

Among the methods to close a TCP connection in the general case, there's:

  • tcpkill (from dsniff package) that fakes the TCP packets that would close a connection.
  • iptstate (Linux). If you're using a statefull firewall. You can remove the connection from the Linux connection tracker table (x in iptstate), which would usually cause newer packets to be ignored (if the firewall is configured to only accept new connections with TCP SYN). It wouldn't kill the connection, just make it inactive though.
  • Add firewall rules to reject further packets transmitted/received in that connection (on Linux, iptables with target "REJECT", matching on source and destination TCP ports and IP addresses in OUTPUT and INPUT filter chains)
  • attach gdb to the running vnc server and do call close(fd) where fd is the file descriptor for the corresponding socket (which you've found out with lsof) followed by detach (it may confuse the vnc server a lot those, calling shutdown instead of close may be safer).
share|improve this answer
FYI, I needed to use sudo to run lsof to get output on my Raspberry Pi (Raspbian/Debian Linux). – HeatfanJohn Nov 5 '12 at 15:14
@HeatfanJohn. Yes a user can only see the information from the processes it owns. So you'd need to be root or the user running the vnc server. – Stéphane Chazelas Nov 5 '12 at 15:52

According to this article the following command will show connections to processes containing "VNC command-line":

# sudo netstat -p | grep <name of VNC command-line>


Please note that the netstat command has to run as root

share|improve this answer

Assuming your vnc server is Xvnc, try this one-liner:

lsof -Pni | grep Xvnc | grep -v LISTEN

This will list active connections and show you their process PID and IP addresses.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.