24

I have a webserver, i need to check number of connections in my server at that given time,

i used following

netstat -anp |grep 80 |wc -l

this returned with

2542

but from my google analytics's i know that simultaneous users is not more than 100.

is this correct ? 
if not how to i get the active number of connections ? 
is this sign of a victim of DOS attack how do i know that ?
  • With ss you can filter port and state a bit faster: ss -nt dport == :80 and state connected. – eckes Dec 9 '17 at 15:32
  • Number of connections is not number of users. Each user browser can open multiple connections at the same time. On the opposite, while more rare, multiple users using the same proxy could appear only through one connection. – Patrick Mevzek Dec 9 '17 at 17:31
44

Try just counting the ESTABLISHED connections:

netstat -anp | grep :80 | grep ESTABLISHED | wc -l

Also, be careful about not using a colon in your port grep statement. Just looking for 80 can lead to erroneous results from pids and other ports that happen to have the characters 80 in their output.

  • 5
    grep -w 80 solves that problem, and eliminates things like 8093. – Michael Hampton Aug 26 '12 at 9:35
  • 1
    yeah, you're right :80 can possibly introduce false positives as well. – d34dh0r53 Aug 26 '12 at 9:39
  • @MichaelHampton Both grep -w 80 and :80 will also count outgoing http connections, if any. netstat -ntp|awk '{print $4}'|grep -w 80. And yes, I care too much about the color of the bikeshed :) :) . – user130370 Aug 26 '12 at 12:25
  • This one is lil improved.. netstat -an | grep -w 80 | grep -i established | awk {'print $5'} | cut -d: -f1 | sort | uniq -c | sort -n – user169015 Sep 25 '14 at 4:45
2

Taking @d34dh0r53 answer one step "further" (towards an answer with a "broader" perspective), you can also check all the connections sorted according to their state with the following:

netstat -ant | grep :<port_num> | awk '{print $6}' | sort | uniq -c | sort -n

for example:

netstat -ant | grep :8000 | awk '{print $6}' | sort | uniq -c | sort -n

A possible output might be:

1 CLOSING
1 established
1 FIN_WAIT2
1 Foreign
2 CLOSE_WAIT
6 FIN_WAIT1
7 LAST_ACK
7 SYN_RECV
37 ESTABLISHED
44 LISTEN
297 TIME_WAIT

Hope it helps and please rise up any elaborations and/or comments you have on the above.

Cheers,

Guy.

1

You could simply put your IP address in there instead of worrying about stringing multiple greps, seds, and awks together.

netstat -anp | grep -c $(hostname -i):80

Using $(hostname -i) will allow the use of this command on any box, static/dynamic IP and so on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.