How do I get the number of (currently) established TCP connections for a specific port?

I have managed to get counters for traffic working by doing i.e for outgoing RTMP.

iptables -N $CHAIN 
iptables -I OUTPUT -j $CHAIN
iptables -A $CHAIN -p tcp --sport 1935

But now i need the number of current (not a counter) connections, for each protocol

I can get the total number with: netstat -ant | grep ESTABLISHED | wc -l

Can anyone help? Im not an iptables guru.


You say you're not a guru, but which of us is? You've done most of the heavy lifting; I'm sure the rest will occur to you in a minute or two.

Until then, try netstat -an|grep ESTABLISHED | grep -w 1935.

  • 1
    lsof -ni:1935 -sTCP:ESTABLISHED | wc -l has also been suggested to me?, is there any benefit between lsof and netstat? – James Bennet Aug 1 '13 at 8:32
  • They both hook into the underlying kernel structures. The binaries are about the same size, so will have comparable memory footprints. Offhand, I can think of no major difference. – MadHatter Aug 1 '13 at 8:33
  • I am being told they are supposed to be slow (The box will have like 20k connections), and to use iptables, but it looks unsuitable to me? – James Bennet Aug 1 '13 at 8:37
  • Iptables seems unsuitable to me, too. Both iptables and netstat/lsof are simply userspace tools that tap into kernel structures, so I'm not quite sure why one would be much slower than the others unless the userspace portions were wildly different in size (they're not). How often do you intend to poll this statistic? – MadHatter Aug 1 '13 at 9:02
  • Every 5 minutes, cron job. – James Bennet Aug 1 '13 at 9:12

It works for me:

# netstat -ant | grep ESTABLISHED | wc -l


total connection 22....
  • Ah, I forgot about the "t" for TCP, thanks. – James Bennet Aug 1 '13 at 9:27

netstat + grep is a good and simple option for a few connections but if you have a huge number of connections I would recommend ss as recommended in nixCraft.

For instance: ss -s

Total: 78 (kernel 79)
TCP:   31 (estab 27, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 16

Transport Total     IP        IPv6
*     79        -         -        
RAW   0         0         0        
UDP   4         2         2        
TCP   31        2         29       
INET      35        4         31       
FRAG      0         0         0  

There is one more command if you want list of ip and number of connection use

netstat -natu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

it gives you ip and connection list...


  • Rackbank, please edit this into your previous answer, instead of posting a second new one. – MadHatter Aug 1 '13 at 9:43
  • this is different from previous one... user will be confuse – Radhe Aug 1 '13 at 11:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.