How to Find Users Who Have Opened a TCP Connection to Your Server on a Certain Number

Finding multiple connections to your server over an IP can always be useful. In many cases, when you receive a DDOS attack, you will see multiple connections over an IP. A command that can be very useful, especially in such a case. For example, you want to list IPs that open more than 50 connections on your server. In this case, you can use the following code;

netstat -n --tcp --udp --numeric-hosts | \
grep -v 127.0.0.1 | \
awk '{if (/(tcp|udp)/) { print $5 }}' | \
sed 's/:.*//' | \
sort | \
uniq -c | \
sort -n | \
awk '{if ($1 > 50) {print "Baglanti Sayisi: "$1"\t"$2; }}'

When you execute the command, you receive an output similar to the following; (Of course, if more than 50 connections are available from a single IP)

Number of Connections: 56   xx.xx.xx.xx
Number of Connections: 77   yy.yy.yy.yy
Number of Connections: 65   zz.zz.zz.zz
Number of Connections: 94   tt.tt.tt.tt

If we only want to list the IPs, then we need to change the last line in the command as follows;

So we only see the connecting IP addresses.

awk '{if ($1 > 50) {print $2; }}

If you have a question, you can drop it under the article. Or you can email us.

I hope it has been a useful article.