How to check if anyone is connected to my laptop through TightVNC?
I would like to check if there is anyone connected to or accessing my laptop, how could I do this?
As indicated in an answer to the Stack Overflow question you have already linked to, running e.g. netstat -an | find "ESTABLISHED" | find ":5900 "
will return something similar to the following if there is currently a connection on port 5900:
If there is no entry that meets the given criteria, nothing will be returned:
Does this
netstat
command work on TightVNC?
TightVNC runs on ports 5900 and 5800 by default. Assuming that TightVNC is running on those ports, the given netstat
command should work fine.
I ran the
netstat
command and it simply terminated afterwards. What does this mean?
It likely means that no one is connected.
However, if you wish to verify the ports that TightVNC is using for its server application, simply right-click on the "Control App" (TightVNC server) icon in the system tray (notification/quick launch area) in Windows and select Configuration:
Then check the Server tab to see which ports are currently assigned in TightVNC:
Is there another, alternative way to check for connections? Is
netstat
an effective way to check already?
I would say that netstat
should be effective, so long as you verify the ports used by TightVNC (above).
It is also probably worth mentioning that the TightVNC server "Control App" icon will change color from "light" to "dark" if anyone is connected to you:
Using Wireshark
If you want yet another way to verify who may or may not be connected to you, you may wish get a copy of Wireshark. Wireshark is "a free and open-source packet analyzer". Essentially, it captures traffic (packets) on your network and can display them to you. This includes traffic generated by TightVNC.
To view TightVNC traffic with Wireshark:
Download and install Wireshark. Make sure to check the box to install WinPcap during installation.
Click the new Wireshark icon on your desktop and wait for the program to load.
-
From the main screen, select an "interface" to monitor (i.e. your primary network card). The items listed are (roughly) the same as those listed under Control Panel\Network and Internet\Network Connections in Windows. For instance, I would double-click "Local Area Connection" (below), which is my primary wired NIC:
-
Packet information should start to scroll by and look something like this:
-
In the bar that says "Apply a display filter...", type "vnc" (you can also use e.g. "tcp.port == 5900" in place of "vnc"). Click the blue arrow at the far end of the bar. This arrow should turn grey when the display filter is properly applied:
-
If there is no eligible TightVNC connection, nothing will be displayed, similar to
netstat
: -
If there is an eligible TightVNC connection, you will still see packets scrolling by but they will be fewer and more consistent. You will also see "VNC" appear in the "Protocol" column. In the screenshot below, you can see the local host (10.0.0.4) running Wireshark (and the TightVNC server) communicating with the remote VNC viewer (10.0.0.40) i.e someone who is accessing the PC: