[NTLUG:Discuss] suspicious output from "last -d" command

[Eric Schnoebelen]

Ed Leach writes:
- Below is output from a "last -d" command. In the man page for
- last it's pretty clear that the -d option lists non-local logins.

Er, your reading of the manual page is in correct.  `-d'
resolves the IP addresses stored in in the wtmp into host names,
rather than displaying them as IP addresses.

I would suggest using `-a' to place the IP address/hostname at the
end of the output line, and then adding `-d' to have it resolve
the IP addresses into hostnames.

- So . . . could anything explain this output other than getting
- broken into?

A poorly implemented login (or X terminal proram, or graphical
login program) not zero-ing a field before writing it to the
utmp/wtmp? (it's been known to happen..)

--
Eric Schnoebelen	eric at cirr.com			http://www.cirr.com
		I have seen the truth and it makes no sense.