Notes
Notes - notes.io |
Posted on August 26, 2012 , Last modified : August 28, 2012
By mkyong
Below is an Unix command to list all the IP addresses connected to your server on port 80.
netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head
Output – Total connections by IP, from highest to lowest.
97 114.198.236.100
56 67.166.157.194
44 170.248.43.76
38 141.0.9.20
37 49.248.0.2
37 153.100.131.12
31 223.62.169.73
30 65.248.100.253
29 203.112.82.128
29 182.19.66.187
Note
This command is useful to detect if your server is under attack, and null route those IPs. Read this null route attacker IP story.
Let break above lengthy command into pieces :
1. netstat -tn 2>/dev/null
Uses netstat to list all network connections, ins and outs.
-n – Display numeric only, don’t resolve into name.
-t – Display only TCP connections.
Output
#Examples - 7 connections
tcp 0 0 64.91.*.*:80 114.198.236.100:12763 TIME_WAIT
tcp 0 0 64.91.*.*:80 175.136.226.244:51950 TIME_WAIT
tcp 0 0 64.91.*.*:80 175.136.226.244:51951 TIME_WAIT
tcp 0 0 64.91.*.*:23 202.127.210.2:14517 TIME_WAIT
tcp 0 0 64.91.*.*:80 149.238.193.121:65268 TIME_WAIT
tcp 0 0 64.91.*.*:80 114.198.236.100:44088 ESTABLISHED
tcp 0 0 64.91.*.*:80 175.136.226.244:51952 TIME_WAIT
2>/dev/null
Redirect all unwanted output to /dev/null, a special place to absorb all output and clear it.
2. grep :80
Only display the IP address that connected to server on port 80.
tcp 0 0 64.91.*.*:80 114.198.236.100:12763 TIME_WAIT
tcp 0 0 64.91.*.*:80 175.136.226.244:51950 TIME_WAIT
tcp 0 0 64.91.*.*:80 175.136.226.244:51951 TIME_WAIT
tcp 0 0 64.91.*.*:80 149.238.193.121:65268 TIME_WAIT
tcp 0 0 64.91.*.*:80 114.198.236.100:44088 ESTABLISHED
tcp 0 0 64.91.*.*:80 175.136.226.244:51952 TIME_WAIT
3. awk ‘{print $5}’
Uses awk to display the 5th field only.
114.198.236.100:12763
175.136.226.244:51950
175.136.226.244:51951
114.198.236.100:44088
175.136.226.244:51952
4. cut -d: -f1
Uses cut to extract the content.
-d – Character immediately following the -d option is use as delimiter, default is tab.
-f – Specifies a field list, separated by a delimiter.
114.198.236.100
175.136.226.244
175.136.226.244
149.238.193.121
114.198.236.100
175.136.226.244
5. sort | uniq -c | sort -nr
Sort the list, group it and sort it again in reverse order.
sort
114.198.236.100
114.198.236.100
149.238.193.121
175.136.226.244
175.136.226.244
175.136.226.244
uniq -c – Group it.
2 114.198.236.100
1 149.238.193.121
3 175.136.226.244
sort -nr – sort by numeric, and reverse order (highest display first)
3 175.136.226.244
2 114.198.236.100
1 149.238.193.121
Done.
6. head
This is optional, to display the first 10 result.
References
/dev/null
Netstat
AWK
Cut
Uniq
Sort
Here are some of my favorite books
You might also like following tutorials :
|
|
Notes.io is a web-based application for taking notes. You can take your notes and share with others people. If you like taking long notes, notes.io is designed for you. To date, over 8,000,000,000 notes created and continuing...
With notes.io;
- * You can take a note from anywhere and any device with internet connection.
- * You can share the notes in social platforms (YouTube, Facebook, Twitter, instagram etc.).
- * You can quickly share your contents without website, blog and e-mail.
- * You don't need to create any Account to share a note. As you wish you can use quick, easy and best shortened notes with sms, websites, e-mail, or messaging services (WhatsApp, iMessage, Telegram, Signal).
- * Notes.io has fabulous infrastructure design for a short link and allows you to share the note as an easy and understandable link.
Fast: Notes.io is built for speed and performance. You can take a notes quickly and browse your archive.
Easy: Notes.io doesn’t require installation. Just write and share note!
Short: Notes.io’s url just 8 character. You’ll get shorten link of your note when you want to share. (Ex: notes.io/q )
Free: Notes.io works for 12 years and has been free since the day it was started.
You immediately create your first note and start sharing with the ones you wish. If you want to contact us, you can use the following communication channels;
Email: [email protected]
Twitter: http://twitter.com/notesio
Instagram: http://instagram.com/notes.io
Facebook: http://facebook.com/notesio
Regards;
Notes.io Team
