14

I am using this simple command to monitor connections (to deal with some recent DoS attacks) on my Debian server:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

How do I run it continuously? So it will refresh itself once per minute (or any given amount of time, of course). I tried watch:

watch -n 30 "netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n"

But it changed the output from nice list with num of connections to something like this:

1 tcp        0  10015 [LOCAL IP]
...
1 Proto Recv-Q Send-Q Local Address           Foreign Address         State
1 Active Internet connections (w/o servers)

So external IP is not being displayed. Is there something I missed?

This is how the original output looks:

  2 [IP ADDRESS]
  4 [IP ADDRESS]
  4 [IP ADDRESS]
  4 [IP ADDRESS]
  7 [IP ADDRESS]
 16 [IP ADDRESS]
 71 [IP ADDRESS]

And when I say [LOCAL IP] I mean my machine's IP.

When I run it with -c it just freezes.

migrated from stackoverflow.com Jun 13 '12 at 10:48

This question came from our site for professional and enthusiast programmers.

  • Are you running watch with root privileges? The command looks sound and seems to behave how I would expect on my machine. Running without will not print the addresses and, after 30 seconds might print an error message. – stew Jun 12 '12 at 13:27
  • @StewartPlatt I run it under root. I added the original command output. The thing is, when I do watch - it outputs only my IP address ad does not output connected to me IPs at all. – pyrate Jun 12 '12 at 13:32
20
netstat -c

may help you if i've not misunderstood your problem. -c stands for --continuous.

EDIT: there you go:

watch -n 30 "netstat -ntu | awk '{print \$5}' | cut -d: -f1 | sort | uniq -c | sort -n"

I've added a \ before $.

  • already tried, sorry I didn't specify this in a question. It just freezes when I add -c. – pyrate Jun 12 '12 at 13:39
  • I realized that, the $5 is removed at the output of watch. Maybe there's a quotation mark issue. I'm digging on it.. – hcg Jun 12 '12 at 13:43
  • thank you, good to know about escaping special chars in watch – pyrate Jun 12 '12 at 13:47
1

Just run a while loop that sleeps for 60 seconds

[root@host] $ while true
> do
> netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
> sleep 60
> done

This will give you the same output every 60 seconds

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.