Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a webserver, i need to check number of connections in my server at that given time,

i used following

netstat -anp |grep 80 |wc -l

this returned with

2542

but from my google analytics's i know that simultaneous users is not more than 100.

is this correct ? 
if not how to i get the active number of connections ? 
is this sign of a victim of DOS attack how do i know that ?
share|improve this question

1 Answer 1

up vote 6 down vote accepted

Try just counting the ESTABLISHED connections:

netstat -anp | grep :80 | grep ESTABLISHED | wc -l

Also, be careful about not using a colon in your port grep statement. Just looking for 80 can lead to erroneous results from pids and other ports that happen to have the characters 80 in their output.

share|improve this answer
    
grep -w 80 solves that problem, and eliminates things like 8093. –  Michael Hampton Aug 26 '12 at 9:35
    
yeah, you're right :80 can possibly introduce false positives as well. –  d34dh0r53 Aug 26 '12 at 9:39
    
@MichaelHampton Both grep -w 80 and :80 will also count outgoing http connections, if any. netstat -ntp|awk '{print $4}'|grep -w 80. And yes, I care too much about the color of the bikeshed :) :) . –  coincoin Aug 26 '12 at 12:25
    
This one is lil improved.. netstat -an | grep -w 80 | grep -i established | awk {'print $5'} | cut -d: -f1 | sort | uniq -c | sort -n –  user169015 Sep 25 at 4:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.