Ssh – Identify the outgoing connection (ssh) with the who command

sshwho

After a ssh connection, if I run the who command on the server : I have this response : 

olivia@olivia-pc:~$ who
olivia   :0           2014-09-08 11:40 (:0)
olivia   pts/0        2014-09-08 11:43 (:0)
olivia   pts/10       2014-09-08 13:54 (sim.local)

So it's easy to identify the incoming connection (third line).

If I run the who command on the client : I have this response : 

who
sim      :0           2014-09-04 16:30 (:0)
sim      pts/10       2014-09-08 13:49 (:0)
sim      pts/0        2014-09-08 13:46 (:0)

So I think that the outgoing connection is the second line because it appears after that I connect to the server with ssh, but I don't understand why is it still there when I run who after that I have closed the connection (and until I leave the terminal).

So my questions are :

1) Is it really the second line that represents the outgoing connection and why?

2) Why is it still visible until I leave the terminal, even if I close the connection?

3) If the outgoing connection is the line two, as I except it to be, is there a reason that server and client use the same pseudo terminal number?

Best Answer

  1. Not necessarily. Either line 2 or 3 is the terminal (eg xterm) that you are using to run the ssh command.
  2. Because it's the terminal, not the ssh connection.
  3. Complete coincidence. If you consider a Windows user connecting to the server using PuTTY, they will not have a local pts and neither will they have the who command to run.

You can try and run the following to see which pts the ssh command is running in:

ps -AF | grep ssh

You should see a pts listed against the ssh command you are using to connect. This is the pts of the xterm (or KDE/Gnome terminal etc) that you are using to run ssh.

ssh itself is connecting to the server using TCP, which you can see using:

ss | grep ssh
Related Question