16

In order to find out who was logged in recently on my server I am using the command:

There were logins from very strange IP addresses e.g.:

username@pc:/home/user$ last
username pts/16       59.224.XX.178.d Sun Aug  2 12:26 - 12:27  (00:00)

(where X was a number).

My question: What does the suffix .d mean? And why are these entries gone when I am using last with the option "-i"?

user
  • 4,335
  • 4
  • 34
  • 71
Jimmy88
  • 341
  • 1
  • 2
  • 10

2 Answers2

41

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it.

Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the hostname gets displayed and long ones get truncated to display nice columns.

Try last -a to display the hostname on the last column without truncation. or last -i to display the ip-address.

Compare:

$ last -n 1  name
name      pts/0        host38.resource. Mon Aug 17 15:46 - 16:00  (00:13)

$ last -n 1 -a name
name      pts/0        Mon Aug 17 15:46 - 16:00  (00:13)     host38.resource.hq.example.com

$ last -n 1 -i name
name      pts/0        10.9.8.38        Mon Aug 17 15:46 - 16:00  (00:13)
HBruijn
  • 77,029
  • 24
  • 135
  • 201
6

The -i makes 'last' show the remote hostname in dots and numbers IP address format instead of trying to display the hostname.

I am not sure what the '.d' suffix is, nor can I find out anything on google. I can only guess it is trying to do a reverse lookup and is giving you part of a hostname and truncating it, although i thought you must specify -d to do hostnames.

tomstephens89
  • 1,011
  • 1
  • 12
  • 24
  • 1
    thanks a lot! i think it was the truncating of the reverse lookup! – Jimmy88 Aug 17 '15 at 15:00
  • 4
    In this case, I suspect that "d" is the first letter of either "dsl" or "dynamic". Hard to tell without knowing the exact IP, though. –  Aug 17 '15 at 18:06
  • yes it was right, now have seen it thanks for your help! – Jimmy88 Aug 18 '15 at 08:51