Tech Support Notes

Netstat

The netstat command displays various network related information such as network connections, routing tables, and a number of network interface and network protocol statistics.

Look for local ports that are established or waiting

netstat -nat | grep -v LISTEN | awk '{ print $4 }' | egrep -o ":([0-9]*)" | sort | uniq -c | sort -n;

Number of unique connections to port (in this example Apache)

netstat -nap|grep IP:80|grep -c ESTABLISHED

Number of connections per IP for the given port

netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' | sort | uniq -c | sort -n | wc -l

Find connection state of all IPs hitting the server

netstat -an | awk '/tcp/ {print $5":"$6}'| grep -v 0.0.0.0 | grep -v :: | cut -d: -f1,3 --output-delimiter=" " | sort | uniq -c | sort -n | awk '{print $2" is connected "$1" in state: "$3}'

Connections to each listening service

netstat -tulnap | awk '{print $7}' | sed -n -e '/[/]/p' | cut -s -d'/' -f2 | sort | uniq -c | sort -nk 1

Find the number of connections marked as TIME_WAIT

netstat -an| grep TIME_| wc -l

Unique IPs hitting a specific port count

netstat -lnta|grep :25|awk '{print $5}'|sed -r 's,::ffff:,,'|cut -d : -f1|sort -u | wc -l

ss

The “ss” stands for socket statistics and is sometimes used as a drop in replacement for netstat. The command investigates the socket and shows information similar to netstat command but it can display more TCP and state informations and since it gets its information directly from kernel space in theory it is faster.

Basic usage

Script for very verbose output

ss -nopieumta | sed -e ":a" -e "$ s/[t,u][c,d]p/\n\n\n&/gp;N;b a"