If you want to see the IP addresses from which logins have occurred on a Linux or OS X system, you can use the last command. E.g.:
$ last ann ann tty2 Thu Jan 5 20:23 - 20:27 (00:03) ann tty2 Thu Jan 5 20:05 - 20:06 (00:00) ann tty2 Thu Jan 5 20:01 - 20:02 (00:00) ann pts/0 8.25.222.2 Sun Oct 30 10:43 - 16:59 (06:16) ann pts/0 192.168.0.2 Tue Oct 11 12:02 - 12:03 (00:00) ann pts/0 192.168.0.2 Tue Oct 11 12:01 - 12:01 (00:00) ann pts/32 192.168.1.6 Sat Jun 11 20:03 - 20:38 (00:35) ann pts/32 192.168.1.6 Sat Jun 11 13:23 - 14:22 (00:58) ann pts/14 192.168.1.5 Sun Feb 14 17:05 - 18:28 (6+01:22) ann pts/6 8.23.51.9 Sun Nov 8 09:23 - 10:16 (00:52) ann pts/6 8.23.51.9 Sat Nov 7 08:54 - 16:42 (07:48) ann pts/7 8.23.51.9 Fri Nov 6 16:47 - 16:49 (00:02) ann pts/6 8.23.51.9 Fri Nov 6 15:48 - 23:33 (07:44) ann pts/0 :0 Thu Sep 10 15:25 - 12:38 (129+22:13) ann :0 :0 Thu Sep 10 15:24 - 12:38 (129+22:14) ann pts/5 :0 Sun Aug 23 11:08 - crash (18+04:03) ann pts/4 :0 Sat Aug 22 21:16 - crash (18+17:56) ann pts/3 :0 Sat Aug 22 09:14 - crash (19+05:58) ann :0 :0 Sat Aug 22 09:07 - crash (19+06:05) ann pts/2 192.168.1.6 Sun Jul 19 15:41 - 20:59 (1+05:18) ann pts/2 192.168.1.5 Mon Jun 22 21:28 - 20:17 (18+22:49) ann pts/2 192.168.1.6 Fri Feb 6 21:26 - 21:26 (00:00) ann pts/5 192.168.0.3 Wed Nov 5 21:07 - 22:15 (01:08) wtmp begins Sun Oct 5 20:09:11 2014 $
In the above case, which is from a Linux system, I didn't recognize the
8.23.51.9 IP address and wondered why the user would be
logging in from that address this past November. The above output doesn't
show the year, however. On a Linux system, though not an OS X system, you can
add the -F option to show the full login and logout times and
dates. When I included that option in the command, I could see that the logins
from that address occurred in 2015, not 2017. I knew the user had gone on
a vacation from November 6 to 8 in 2015, so the address would have been for
the Internet Service Provider (ISP) for the hotel where she stayed then.
$ last ann -F ann tty2 Thu Jan 5 20:23:59 2017 - Thu Jan 5 20:27:16 2017 (00:03) ann tty2 Thu Jan 5 20:05:58 2017 - Thu Jan 5 20:06:52 2017 (00:00) ann tty2 Thu Jan 5 20:01:27 2017 - Thu Jan 5 20:02:05 2017 (00:00) ann pts/0 8.25.222.2 Sun Oct 30 10:43:00 2016 - Sun Oct 30 16:59:25 2016 (06:16) ann pts/0 192.168.0.2 Tue Oct 11 12:02:58 2016 - Tue Oct 11 12:03:04 2016 (00:00) ann pts/0 192.168.0.2 Tue Oct 11 12:01:11 2016 - Tue Oct 11 12:01:15 2016 (00:00) ann pts/32 192.168.1.6 Sat Jun 11 20:03:22 2016 - Sat Jun 11 20:38:47 2016 (00:35) ann pts/32 192.168.1.6 Sat Jun 11 13:23:32 2016 - Sat Jun 11 14:22:16 2016 (00:58) ann pts/14 192.168.1.5 Sun Feb 14 17:05:43 2016 - Sat Feb 20 18:28:03 2016 (6+01:22) ann pts/6 8.23.51.9 Sun Nov 8 09:23:48 2015 - Sun Nov 8 10:16:34 2015 (00:52) ann pts/6 8.23.51.9 Sat Nov 7 08:54:13 2015 - Sat Nov 7 16:42:55 2015 (07:48) ann pts/7 8.23.51.9 Fri Nov 6 16:47:07 2015 - Fri Nov 6 16:49:33 2015 (00:02) ann pts/6 8.23.51.9 Fri Nov 6 15:48:53 2015 - Fri Nov 6 23:33:31 2015 (07:44) ann pts/0 :0 Thu Sep 10 15:25:08 2015 - Mon Jan 18 12:38:28 2016 (129+22:13) ann :0 :0 Thu Sep 10 15:24:24 2015 - Mon Jan 18 12:38:41 2016 (129+22:14) ann pts/5 :0 Sun Aug 23 11:08:54 2015 - crash (18+04:03) ann pts/4 :0 Sat Aug 22 21:16:08 2015 - crash (18+17:56) ann pts/3 :0 Sat Aug 22 09:14:13 2015 - crash (19+05:58) ann :0 :0 Sat Aug 22 09:07:22 2015 - crash (19+06:05) ann pts/2 192.168.1.6 Sun Jul 19 15:41:41 2015 - Mon Jul 20 20:59:50 2015 (1+05:18) ann pts/2 192.168.1.5 Mon Jun 22 21:28:09 2015 - Sat Jul 11 20:17:11 2015 (18+22:49) ann pts/2 192.168.1.6 Fri Feb 6 21:26:53 2015 - Fri Feb 6 21:26:58 2015 (00:00) ann pts/5 192.168.0.3 Wed Nov 5 21:07:36 2014 - Wed Nov 5 22:15:51 2014 (01:08) wtmp begins Sun Oct 5 20:09:11 2014 $
You can have the hostname/IP address appear in the last column of the
output from the command by using the -a option on a Linux
system. E.g.:
$ last ann -a ann tty2 Thu Jan 5 20:23 - 20:27 (00:03) ann tty2 Thu Jan 5 20:05 - 20:06 (00:00) ann tty2 Thu Jan 5 20:01 - 20:02 (00:00) ann pts/0 Sun Oct 30 10:43 - 16:59 (06:16) 8.25.222.2 ann pts/0 Tue Oct 11 12:02 - 12:03 (00:00) 192.168.0.2 ann pts/0 Tue Oct 11 12:01 - 12:01 (00:00) 192.168.0.2 ann pts/32 Sat Jun 11 20:03 - 20:38 (00:35) 192.168.1.6 ann pts/32 Sat Jun 11 13:23 - 14:22 (00:58) 192.168.1.6 ann pts/14 Sun Feb 14 17:05 - 18:28 (6+01:22) 192.168.1.5 ann pts/6 Sun Nov 8 09:23 - 10:16 (00:52) 8.23.51.9 ann pts/6 Sat Nov 7 08:54 - 16:42 (07:48) 8.23.51.9 ann pts/7 Fri Nov 6 16:47 - 16:49 (00:02) 8.23.51.9 ann pts/6 Fri Nov 6 15:48 - 23:33 (07:44) 8.23.51.9 ann pts/0 Thu Sep 10 15:25 - 12:38 (129+22:13) :0 ann :0 Thu Sep 10 15:24 - 12:38 (129+22:14) :0 ann pts/5 Sun Aug 23 11:08 - crash (18+04:03) :0 ann pts/4 Sat Aug 22 21:16 - crash (18+17:56) :0 ann pts/3 Sat Aug 22 09:14 - crash (19+05:58) :0 ann :0 Sat Aug 22 09:07 - crash (19+06:05) :0 ann pts/2 Sun Jul 19 15:41 - 20:59 (1+05:18) 192.168.1.6 ann pts/2 Mon Jun 22 21:28 - 20:17 (18+22:49) 192.168.1.5 ann pts/2 Fri Feb 6 21:26 - 21:26 (00:00) 192.168.1.6 ann pts/5 Wed Nov 5 21:07 - 22:15 (01:08) 192.168.0.3 wtmp begins Sun Oct 5 20:09:11 2014 $
