Checking Apache Connections

You can use the following command to see how many connections a specific IP has to an Apache server running on port 80.

The more connections from an IP, the more of a chance that the server could be under some type of attack from that IP.

 netstat -tn --inet 2> /dev/null| grep ':80' | awk '/tcp[\ ]*[0-9]+[\ ]*[0-9]+[\ ]+[^\ ]+[\ ]*[^\ ]*/ { print $5; }' | cut -d':' -f1 | sort | uniq -c | sort -n

Ralph Gervolino

Leave a Reply