Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

How do I run it continuously? So it will refresh itself once per minute (or any given amount of time, of course). I tried watch:

watch -n 30 "netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n"

But it changed the output from nice list with num of connections to smth like this:

1 tcp        0  10015 [LOCAL IP]
1 Proto Recv-Q Send-Q Local Address           Foreign Address         State
1 Active Internet connections (w/o servers)

So external IP is not being displayed... Is there's something I missed?

EDIT: This is how the original output looks:


And when I say [LOCAL IP] - I mean my machine's IP.

EDIT 2: Forgot to add - it just freezes when I run it with -c.

share|improve this question

migrated from Jun 13 '12 at 10:48

This question came from our site for professional and enthusiast programmers.

Are you running watch with root privileges? The command looks sound and seems to behave how I would expect on my machine. Running without will not print the addresses and, after 30 seconds might print an error message. – stew Jun 12 '12 at 13:27
@StewartPlatt I run it under root. I added the original command output. The thing is, when I do watch - it outputs only my IP address ad does not output connected to me IPs at all. – pyrate Jun 12 '12 at 13:32
up vote 9 down vote accepted
netstat -c

may help you if i've not misunderstood your problem. -c stands for --continuous.

EDIT: there you go:

watch -n 30 "netstat -ntu | awk '{print \$5}' | cut -d: -f1 | sort | uniq -c | sort -n"

I've added a \ before $.

share|improve this answer
already tried, sorry I didn't specify this in a question. It just freezes when I add -c. – pyrate Jun 12 '12 at 13:39
I realized that, the $5 is removed at the output of watch. Maybe there's a quotation mark issue. I'm digging on it.. – hcg Jun 12 '12 at 13:43
thank you, good to know about escaping special chars in watch – pyrate Jun 12 '12 at 13:47

Just run a while loop that sleeps for 60 seconds

[root@host] $ while true
> do
> netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
> sleep 60
> done

This will give you the same output every 60 seconds

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.