How to tell who is connected via vnc to my machine?

Question

How do I check how many vnc connections or different users are currently connected to my machine? Only through wireshark? And how do I kill any other users connected through vnc?

Solution

On Linux,

ss sport = :5900

Would tell you the currently established TCP connections on port 5900.

For anything else, we'd need to know what VNC server you're using as there exist dozens.

If you know the name of the VNC server command,

lsof -ai tcp -c that-command

(as the user running the VNC server or as root) would also tell you the currently established TCP connections handled by that VNC server (in case it's not on port 5900).

Among the methods to close a TCP connection in the general case, there's:

• tcpkill (from dsniff package) that fakes the TCP packets that would close a connection.
• iptstate (Linux). If you're using a statefull firewall. You can remove the connection from the Linux connection tracker table (x in iptstate), which would usually cause newer packets to be ignored (if the firewall is configured to only accept new connections with TCP SYN). It wouldn't kill the connection, just make it inactive though.
• Add firewall rules to reject further packets transmitted/received in that connection (on Linux, iptables with target "REJECT", matching on source and destination TCP ports and IP addresses in OUTPUT and INPUT filter chains)
• attach gdb to the running vnc server and do call close(fd) where fd is the file descriptor for the corresponding socket (which you've found out with lsof) followed by detach (it may confuse the vnc server a lot those, calling shutdown instead of close may be safer).

Comments

[AshMv]

FYI, I needed to use sudo to run lsof to get output on my Raspberry Pi (Raspbian/Debian Linux).

[Stéphane Chazelas]

@HeatfanJohn. Yes a user can only see the information from the processes it owns. So you'd need to be root or the user running the vnc server.