When a client machine connects to a server via network, a connection is established and opened on the system. The load on the server goes high as the number of connections to the server are high, the number can be in thousands. It also help in finding out and get a list of connections on the server by each node, client or IP address is useful for system scaling planning, and in most cases, detect and determine whether a web server is under DoS or DDoS attack (Distributed Denial of Service), where an IP sends large amount of connections to the server.
We use the ‘netstat’ command to find the number of connections from each IP to the server.
Login to the server via SSH and execute the following on the command line.netstat -an |grep tcp|awk '{print $5}'|cut -d: -f1|sort|uniq -c|sort -n
The output will be like as follows.
2 123.345.576 26 121.123.123 124 111.111.111 1 222.222.222
The first column indicates the number of connections from the IP that listed in the second column.
That’s it, hope the above helped you. Thank you!