
How to Find Users Who Have Opened a TCP Connection to Your Server on a Certain Number
Finding multiple connections to your server over an IP can always be useful. In many cases, when you receive a DDOS attack, you will see multiple connections over an IP. A command that can be very useful, especially in such a case. For example, you want to list IPs that open more than 50 connections on your server. In this case, you can use the following code;
netstat -n --tcp --udp --numeric-hosts | \
grep -v 127.0.0.1 | \
awk '{if (/(tcp|udp)/) { print $5 }}' | \
sed 's/:.*//' | \
sort | \
uniq -c | \
sort -n | \
awk '{if ($1 > 50) {print "Baglanti Sayisi: "$1"\t"$2; }}'
When you execute the command, you receive an output similar to the following; (Of course, if more than 50 connections are available from a single IP)



