Netstat
My most frequently used netstat command with parameters for checking port (active internet) connections is:
$ netstat -tulpn
You can also pipe the output to grep to filter for specific ports or addresses.
Here is a brief listing of some of the many options:
$ netstat [options]
| Option | Action |
|---|---|
| -a | Display the state of all sockets, not just the active. |
| -c | Continuously display information, updating every second. |
| -i | Include network device statistics. |
| -n | Display all network addresses as numbers. |
| -o | Display additional information. |
| -r | Display routing tables. |
| -t | Display only the TCP sockets. |
| -u | Display only the UDP sockets. |
| -v | Print the netstat version number and exit. |
| -w | List only the raw sockets. |
| -x | Display only the Unix sockets. |
List TCP Connections Sorted By Host and Most Connections
Assuming your system still has netstat installed (Slackware 15.0 does :^), you can summarize the TCP connections on you host using the following command:
$ netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r3 52.50.230.xxx3 104.18.27.xxx3 104.18.26.xxx2 205.166.94.xx2 192.168.1.xx2 142.251.40.xxx2 104.18.13.xx1 74.120.9.xxx1 66.255.245.xxx1 54.154.65.xxx1 52.96.182.xxx1 45.56.116.xxx1 45.33.73.xxx1 34.117.65.xx1 20.190.135.xx1 192.168.122.xxx1 192.168.1.xx1 172.253.63.xxx1 162.159.61.x1 162.125.21.x1 142.251.40.xxx1 142.251.32.xxx1 142.251.16.xxx1 127.0.0.x