1780 connections from one IP

postcd · 03-28-2014, 06:40 AM

Hello, one US IP having 1700+ connections when doing:

Code:

netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

1780 *
... *
... *

i want to ask how to debug what this IP does?

sundialsvcs · 03-28-2014, 08:02 AM

It's suspicious, but not necessarily damning. Perhaps this "one IP" is the corporate router of your biggest and most fantastic customer, whose hundreds of internal computers each have two connections to your million-dollar revenue-producing service. You know your app best ... what does this usage pattern "smell like" to you?

abefroman · 03-28-2014, 10:13 AM

You might want to use this command instead:

Code:

netstat -an |grep :80 |awk {'print $5'} |awk -F: {'print $1'} |sort -n |uniq -c |sort -n