Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

How do I run it continuously? So it will refresh itself once per minute (or any given amount of time, of course). I tried watch:

watch -n 30 "netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n"

But it changed the output from nice list with num of connections to smth like this:

1 tcp        0  10015 [LOCAL IP]
1 Proto Recv-Q Send-Q Local Address           Foreign Address         State
1 Active Internet connections (w/o servers)

So external IP is not being displayed... Is there's something I missed?

EDIT: This is how the original output looks:


And when I say [LOCAL IP] - I mean my machine's IP.

EDIT 2: Forgot to add - it just freezes when I run it with -c.

share|improve this question

migrated from stackoverflow.com Jun 13 '12 at 10:48

This question came from our site for professional and enthusiast programmers.

Are you running watch with root privileges? The command looks sound and seems to behave how I would expect on my machine. Running without will not print the addresses and, after 30 seconds might print an error message. –  stew Jun 12 '12 at 13:27
@StewartPlatt I run it under root. I added the original command output. The thing is, when I do watch - it outputs only my IP address ad does not output connected to me IPs at all. –  pyrate Jun 12 '12 at 13:32

1 Answer 1

up vote 6 down vote accepted
netstat -c

may help you if i've not misunderstood your problem. -c stands for --continuous.

EDIT: there you go:

watch -n 30 "netstat -ntu | awk '{print \$5}' | cut -d: -f1 | sort | uniq -c | sort -n"

I've added a \ before $.

share|improve this answer
already tried, sorry I didn't specify this in a question. It just freezes when I add -c. –  pyrate Jun 12 '12 at 13:39
I realized that, the $5 is removed at the output of watch. Maybe there's a quotation mark issue. I'm digging on it.. –  hcg Jun 12 '12 at 13:43
thank you, good to know about escaping special chars in watch –  pyrate Jun 12 '12 at 13:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.