Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I am under a DDOS attack. I'm trying to locate the IP address that is making 1100+ connections, however, when running the following command, it shows a 1100+ connection, but the ip address column is blank. By the way, I'm using CSF firewall to block connections.

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

This is what it returns. Notice the blank column next to "1157".


How can I find that missing IP address?


share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 17:22

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Unless your netstat is completely different than mine, you have 1157 listening (not connected) IPv6 sockets. These (shown as :::*) are the only ones that come out blank. Run netstat -anp by itself and pick a few lines that don't have any of those IP addresses you found, and show us what you're getting. – DerfK Jul 14 '11 at 18:51

netstat is returning connections like this:

udp 0 0 :::57817 :::*

which, if piped into "cut -d: f1", will return a blank line.

that said, and apologies if this seems condecending, how do you know that you're being DDoS'd?

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.