the IBM i OS has an interactive utility to show users from remote connections.
For 5250 sessions, run:
NETSTAT OPTION(*CNN)
A display will come up that shows all of the currently active IP4 TCP/IP connections to your system. Page down several panels until you see an IP address showing up in the left hand "Remote Address" column. Look for IP addresses that you don't recognize. If you see any for 127.0.0.1, these are probably tied to your use of IBM Navigator for i. The listing under the "Remote Port" and "Local Port" column will give you an idea of what the connection is doing on your system.
For Navigator i:
Select "Network", "TCP/IP Configuration", "IPv4" and finally "IPv4 Connections" to get the same information as the NETSTAT command above. This interface has the added bonus of allowing you to generate listings or a CSV download version of what you are looking at.
Both interfaces give you the option of stopping a connection from an unfamiliar IP.
It is imperative to investigate suspicious connections. Check your exit point implementation for source IP address controls. Connection attempts will show up with the NETSTAT command before they are denied by your exit point implementation.
Run Kisco SafeNet/i for maximum exit point visibility and control
Also consider Kisco iEventMonitor for real-time alerting or auto-termination for unfamiliar IP connections.
