Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I am under a DDOS attack. I'm trying to locate the IP address that is making 1100+ connections, however, when running the following command, it shows a 1100+ connection, but the ip address column is blank. By the way, I'm using CSF firewall to block connections.

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

This is what it returns. Notice the blank column next to "1157".

      1    xxx.xx.xx.xxx
      1    xx.xxx.xxx.xx
      2    xx.xxx.xxx.xxx
      2    xx.xx.xxx.xxx
      3    xx.xxx.xxx.xx
     63    xx.xxx.xxx.xxx
   1157

How can I find that missing IP address?

Thanks.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 17:22

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Unless your netstat is completely different than mine, you have 1157 listening (not connected) IPv6 sockets. These (shown as :::*) are the only ones that come out blank. Run netstat -anp by itself and pick a few lines that don't have any of those IP addresses you found, and show us what you're getting. –  DerfK Jul 14 '11 at 18:51
add comment

1 Answer 1

netstat is returning connections like this:

udp 0 0 :::57817 :::*

which, if piped into "cut -d: f1", will return a blank line.

that said, and apologies if this seems condecending, how do you know that you're being DDoS'd?

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.