Exactly. Probably ps -l (or maybe install and use pstree). Do you get
new processes with sshd as a parent?
I never get that. When ssh-ing into another machine I just get a single ssh
process that's a direct child of the bash for that tty, there's never an
sshd anywhere.
When you use ps -l you will only see processes with a controlling
terminal.
This assumes I'm running ps without any command line arguments.
But the PPID column relates each process to its parent
process. If you start at any arbitrary process and trace back to its
parent, and then to that process's parent, you will eventually find a
PPID for a process that did not show up in ps -l. That will probably
be the process id of sshd.
I know how ps works :)
On OSX, an outbound ssh connection spawns a single 'ssh' process, which
is a child of bash. bash is a child of login. login is a child of
Terminal. Terminal is a child of the launchd process for my account.
That launchd process is a child of the master launchd process, PID 1.
The (abbreviated) output of ps looks like this:
TTY USER RUSER PPID PID COMMAND
?? root root 0 1 launchd
?? Quartz Quartz 1 208 launchd
?? Quartz Quartz 208 241 Terminal
s000 root Quartz 241 246 login
s000 Quartz Quartz 246 249 -bash
s000 Quartz Quartz 249 3212 ssh
On OSX, "sshd" is the receiving server side of the ssh connection. It
only runs when I have an ssh connection INTO my machine, not when I'm
connecting to someone else. The only other ssh related process is
"ssh-agent", but that's always running no matter what.
Or: ps -lx | grep 'ssh[d]'
Not sure what OS / version of grep you're using. On OSX this yields no
output even when ssh processes are running. If I shorten the regex to
just 'ssh' I see the ssh process and ssh-agent which I mentioned above.
