47

I have a webserver, i need to check number of connections in my server at that given time,

i used following 

netstat -anp |grep 80 |wc -l

this returned with 

2542

but from my google analytics's i know that simultaneous users is not more than 100.

is this correct ? 
if not how to i get the active number of connections ? 
is this sign of a victim of DOS attack how do i know that ?
Improve this question
2
  • With ss you can filter port and state a bit faster: ss -nt dport == :80 and state connected.
    – eckes
    Dec 9, 2017 at 15:32
  • Number of connections is not number of users. Each user browser can open multiple connections at the same time. On the opposite, while more rare, multiple users using the same proxy could appear only through one connection.
    – Patrick Mevzek
    Dec 9, 2017 at 17:31

5 Answers 5

Reset to default
80

Try just counting the ESTABLISHED connections:

netstat -anp | grep :80 | grep ESTABLISHED | wc -l

Also, be careful about not using a colon in your port grep statement. Just looking for 80 can lead to erroneous results from pids and other ports that happen to have the characters 80 in their output.

Improve this answer
4
  • 8
    grep -w 80 solves that problem, and eliminates things like 8093.
    – Michael Hampton
    Aug 26, 2012 at 9:35
  • 1
    yeah, you're right :80 can possibly introduce false positives as well.
    – d34dh0r53
    Aug 26, 2012 at 9:39
  • 1
    @MichaelHampton Both grep -w 80 and :80 will also count outgoing http connections, if any. netstat -ntp|awk '{print $4}'|grep -w 80. And yes, I care too much about the color of the bikeshed :) :) .
    – user130370
    Aug 26, 2012 at 12:25
  • This one is lil improved.. netstat -an | grep -w 80 | grep -i established | awk {'print $5'} | cut -d: -f1 | sort | uniq -c | sort -n
    – user169015
    Sep 25, 2014 at 4:45
12 
ss -tn src :80 or src :443

This will show all connections to the local ports 80 or 443 (add/modify port(s) if needed).

Disclaimer: I realize this is an old question, but it's still the top result at Google, so I think it deserves an answer utilizing modern utilities.

Improve this answer
6

Taking @d34dh0r53 answer one step "further" (towards an answer with a "broader" perspective), you can also check all the connections sorted according to their state with the following:

netstat -ant | grep :<port_num> | awk '{print $6}' | sort | uniq -c | sort -n

for example:

netstat -ant | grep :8000 | awk '{print $6}' | sort | uniq -c | sort -n

A possible output might be:

1 CLOSING
1 established
1 FIN_WAIT2
1 Foreign
2 CLOSE_WAIT
6 FIN_WAIT1
7 LAST_ACK
7 SYN_RECV
37 ESTABLISHED
44 LISTEN
297 TIME_WAIT

Hope it helps and please rise up any elaborations and/or comments you have on the above.

Cheers,

Guy.

Improve this answer
2

You could simply put your IP address in there instead of worrying about stringing multiple greps, seds, and awks together.

netstat -anp | grep -c $(hostname -i):80

Using $(hostname -i) will allow the use of this command on any box, static/dynamic IP and so on.

Improve this answer
1

This is also done with a modern utility like ss

For example, trying to get all TCP connections established on port 8080

ss -tn src :8080 | grep -i "estab" | wc -l

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .