DE

↑ ↓ select, Enter open, Esc close

Count web server connections per IP address

harmlessNetworkalle
user@server
ss -Htn state established '( sport = :80 or sport = :443 )' | awk '{print $4}' | rev | cut -d: -f2- | rev | sort | uniq -c | sort -rn | head -20

Lists all established TCP connections to the web ports, cuts off the remote port number and counts the connections per IP. The addresses with the most simultaneous connections appear at the top. Useful when the server suddenly slows down and a crawler or attacker is suspected.

Note: If a reverse proxy or CDN sits in front, its addresses appear instead of the real visitors.

Also searched as

  • count connections per ip linux
  • find ip with most connections
  • server slow check for ddos

Related one-liners

All in Network

Count TCP connections by state

$ss -Htan | awk '{print $1}' | sort | uniq -c | sort -rn
harmlessNetwork

Show outgoing SMTP connections and their processes

#ss -Htnp state established '( dport = :25 )'
harmlessNetwork

List open ports and listening services

#ss -tulpn
harmlessNetwork

Check if Plesk is listening on ports 8443 and 8880

#ss -tlnp | grep -E ':(8443|8880)\b'
harmlessPlesk

Compare max connections with the peak so far

#mysql -e "SHOW GLOBAL STATUS LIKE 'Max_used_connections'; SHOW GLOBAL VARIABLES LIKE 'max_connections';"
harmlessMySQL and MariaDB

Find out which process is using a port

#ss -tlnp 'sport = :80'
harmlessProcesses

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.