If your use-case is from ssh'ing in a remote box, this may be simpler: #!/bin/sh # example from `who - u`: #nick pts/0 2011-07-20 20:44 . 7856 (xxxx

If your use-case is from ssh'ing in a remote box, this may be simpler: #!/bin/sh # example from `who - u`: #nick pts/0 2011-07-20 20:44 . 7856 (xxxxxxx.xxxxxxxx.internode.on.net) who -u | awk 'BEGIN {FS="[p.]"} /internode/ {print gensub("-",".","g",$6); exit}' You might need to play around with gensub(...). Sometime `who` reports the IP as xxx-xxx-xxx-xxx and sometimes as xxx.xxx.xxx.xxx