Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP.

netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

and result of this command was:


583 connection without IP, how can i fix this problem? server load over 20

tnx for your help.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

When you say "how can I fix this promlem?" Do you mean, the problem of being DDoS'ed or for actively monitoring of it? – jwbensley Jun 30 '12 at 12:25

1 Answer 1

It probably wasn't a dDOS attack with that small a level of connected IPs.

The final line represents the output from netstat -anp where there is no foreign address actually defined. If the port is not yet established, the port number is shown as an asterisk (*) - likely UDP ports.

There are a lot of handy one-liner netstat commands to evaluate connections

Show number of connections by state

netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n

Show all IPs connected

netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq

Show number of connections per IP

netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n

Referenced from Cyberciti

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.