Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a webserver, i need to check number of connections in my server at that given time,

i used following

netstat -anp |grep 80 |wc -l

this returned with


but from my google analytics's i know that simultaneous users is not more than 100.

is this correct ? 
if not how to i get the active number of connections ? 
is this sign of a victim of DOS attack how do i know that ?
share|improve this question
up vote 18 down vote accepted

Try just counting the ESTABLISHED connections:

netstat -anp | grep :80 | grep ESTABLISHED | wc -l

Also, be careful about not using a colon in your port grep statement. Just looking for 80 can lead to erroneous results from pids and other ports that happen to have the characters 80 in their output.

share|improve this answer
grep -w 80 solves that problem, and eliminates things like 8093. – Michael Hampton Aug 26 '12 at 9:35
yeah, you're right :80 can possibly introduce false positives as well. – d34dh0r53 Aug 26 '12 at 9:39
@MichaelHampton Both grep -w 80 and :80 will also count outgoing http connections, if any. netstat -ntp|awk '{print $4}'|grep -w 80. And yes, I care too much about the color of the bikeshed :) :) . – user130370 Aug 26 '12 at 12:25
This one is lil improved.. netstat -an | grep -w 80 | grep -i established | awk {'print $5'} | cut -d: -f1 | sort | uniq -c | sort -n – user169015 Sep 25 '14 at 4:45

You could simply put your IP address in there instead of worrying about stringing multiple greps, seds, and awks together. netstat -anp | grep -c This would be a problem with hosts on dynamic IPs, but most hosts are static. Just remember to update the script if you move the host.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.