"The mind of a Mad Tech!"

There are 2 commands I like to use to see the number of connections of a Linux server.  These commands a useful in determing the traffic that is hiiting your server and also helps to see if you are being DDos’d. The basic command will show the ip’s connected to the server, but in no specific order and also does not display how many ip’s are connected at any given time on a port. You can change the port number as needed;

netstat -an |grep :80 |wc -l

The next command is golden. This will show the number of connections active to a port and will display the number of connections from that ip in order;

netstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

Tags: ddos, ips, Linux, netstats