I've just run the command on my server

netstat -atnp

It shows 2 established connection via SSH Port, but when I run the command


It shows only 1 shell user. Is there anything I need to worry about? If so, what could it be? & how to find out about what it's about?

  • 1
    is it possible that one of the SSH connections is outside connection? if not, edit your question and add the output of w and netstat -atnp | grep -i ssh – Yaron Apr 4 '17 at 11:19
  • @Yaron what do you mean by outside connection? – Sollosa Apr 4 '17 at 11:35
  • Is it possible that the user logged into the system, ssh from this machine into another machine? is it possible that the ssh connection is outside the machine? – Yaron Apr 4 '17 at 11:37
  • If I misunderstood please just tell me and I will remove my answer. If you could provide output netstat -atnp | grep -F ":22" it would help to understand – Kiwy Apr 4 '17 at 11:40
  • 1
    ssh transport can be used for things other than a shell login; most obviously sftp and scp, but other protocols can layer on top of an ssh connection as well. – user4556274 Apr 4 '17 at 11:52

In fact you shouldn't be worry.
netstat -a will show every socket (open, listenning, closed...) wo there's probably only your listening ssh deamon plus your current connection.
In your specific case, I would use lsof -i TCP:22 which is in my opinion far more readable.

lsof -i TCP:22
sshd     9760               root    3r  IPv4 20888000      0t0  TCP internalIP:ssh->RemoteIP:58828 (ESTABLISHED)
sshd     9765               another 3u  IPv4 20888000      0t0  TCP InternalIP:ssh->RemoteIP:58828 (ESTABLISHED)
sshd    10348               root    3u  IPv4 12609613      0t0  TCP *:ssh (LISTEN)
sshd    10348               root    4u  IPv6 12609615      0t0  TCP *:ssh (LISTEN)    enter code here

In this output you can see the two open connection and the 2 listenning in IPv4 and IPv6.

Edit 1:
If you're using sudo, it will be virtually like having 2 SSH connections opened. And using who show you will only see your username and not the root logged-in. If you have done a sudo su -:

username pts/0        2017-04-04 13:19 (MY_PUB_IP)
sudo su -
:~# who
username pts/0        2017-04-04 13:19 (MY_PUB_IP)
  • Well it does show more details, but I got even confused. Actually it shows more established connection on ssh than via netstat. FYI, the server is a virtualized environment, and is most probably connected to a centralized mgmt console. Does that info help? – Sollosa Apr 4 '17 at 12:01
  • @Sollosa you should edit your answer with more details output so I can help. BTW, if you see several ssh connection from same ephemeral port (here 58828), it means that you only have one SSH connection. – Kiwy Apr 12 '17 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.