Internet Security Professional Reference, Second Edition
(Publisher: Macmillan Computer Publishing)
Author(s): Authors Multiple
ISBN: 156205760x
Publication Date: 07/16/97

Previous Table of Contents Next


The finger Command

By default, finger lists the login name, full name, terminal name and terminal write status (as a “*” before the terminal name if write permission is denied), idle time, login time, office location, and phone number (if known) for each current user.


Note:  Idle time is minutes if it is a single integer, hours and minutes if a colon (:) is present, or days and hours if a “d” is present.

Longer format also exists and is used by finger whenever a list of names is given. (Account names as well as first and last names of users are accepted.) This is a multiline format; it includes all the information described earlier as well as the user’s home directory, login shell, any plan the user has placed in the .plan file in her home directory, and the project on which she is working from the .project file that is also in her home directory. The output of finger is illustrated here:

$ finger chare
Login name: chare       (messages off)  In real life: Chris Hare
Directory: /u/chare                     Shell: /bin/ksh
On since Oct  8 22:06:31 on ttyp0
Project: Not assigned to one (yet).
Plan:
To complete the currently assigned tasks.

In the preceding code, the output from this finger command is for a user who is currently logged into the system. Notice the (messages off) text. This indicates that any attempts to contact this user with the write command will fail because the user does not allow writes to her terminal. When the user is not logged in, the output is different, as shown here:

$ finger andrewg
Login name: andrewg                     In real life: Andrew Goodier
Directory: /u/andrewg                   Shell: /bin/ksh
Last login Sun Sep 18 22:08
No Plan.
$

The following table lists the options that typically are available on the finger command.

Table 1.7
finger Options

Option Description

-b Briefer output format
-f Suppresses the printing of the header line (short format)
-i Provides a quick list of users with idle times
-l Forces long output format
-p Suppresses printing of the .plan files
-q Provides a quick list of users
-s Forces short output format
-w Forces narrow format list of specified users

It is important for you to recognize that the finger command enables the distribution of valuable user information, such as user names and home directories. For this reason, many sites choose to disable the finger daemon and remove the finger command entirely.

The netstat Command

The netstat command is used to query the network subsystem regarding certain types of information. netstat, for example, can be used to print the routing tables, active connections, streams in use (on those systems that use streams), and more. netstat prints the information in a symbolic format that is easier for the user to understand. The options for netstat are listed in table 1.8.

Table 1.8
netstat Options

Option Description

-A Shows the addresses of any associated protocol control blocks. This option is primarily used for debugging only.
-a Instructs netstat to show the status of all sockets. Normally, the sockets associated with server processes are not shown.
-i Shows the state of the interfaces that have been autoconfigured. Those interfaces that have been configured after the initial boot of the system are not shown in the output.
-m Prints the network memory usage.
-n Causes netstat to print the actual addresses instead of interpreting them and displaying a symbol such as a host or network name.
-r Prints the routing tables.
-f address-family Causes netstat to print only the statistics and control block information for the named address family. Currently, the only address family supported is inet.
-I interface Shows the interface state for only the named interface.
-p protocol-name Limits the statistics and protocol control block information to the named protocol.
-s Causes netstat to show the per protocol statistics.
-t Replaces the queue length information with timer information in the output displays.

The output from netstat in the following code illustrates the retrieval of interface statistics from the interfaces on the system.

$ netstat -i
Name  Mtu   Net/Dest      Address      Ipkts    Ierrs  Opkts    Oerrs
le0   1500  198.73.138.0  chelsea      2608027  26     1421823  1
lo0   1536  loopback      127.0.0.1    765364   0      765364   0

Collis Queue
2632   0
0      0
$ netstat -in
Name  Mtu   Net/Dest      Address      Ipkts    Ierrs  Opkts    Oerrs
le0   1500  198.73.138.0  198.73.138.6 2608082  26     1421862  1
lo0   1536  127.0.0.0     127.0.0.1    765364   0      765364   0

Collis Queue
2632   0
0      0
$

In the second invocation of netstat in the preceding code, the use of the -n option is employed. This causes netstat to print the address instead of the symbolic name that was printed in the first invocation of netstat. This information is dependent upon the link level driver for the interface. If that driver does not attach itself to the ifstats structure in the kernel, then the phrase No Statistics Available is printed.


Previous Table of Contents Next