View what IP’s are generating the most connections to your web server, from least to most connections:
netstat -anp |grep ‘tcp|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
The result will look like this:
117 0.0.0.0
158 172.27.10.75
354 172.27.10.140
If you want to see how many connections are in a certain state of the TCP/IP handshake, use this command:
$ netstat -tan | grep ‘:80 ‘ | awk ‘{print $6}’ | sort | uniq -c
The result will look like this:
282 CLOSE_WAIT
230 ESTABLISHED
2 FIN_WAIT2
1 LAST_ACK
1 LISTEN
330 TIME_WAIT