User:Daveh/countips.sh

#!/bin/sh
#
# Counts tcp/udp connections by IP address sorted by count. 
# Add an optional connection type (TIME_WAIT, ESTABLISHED, etc...) to only display connections of that type.
#

TYPEFILTER="$1"

if [ -z "$TYPEFILTER" ]
then
        echo "Counting all connections by IP address:"
        netstat -an | egrep "^tcp|^udp" | awk '{print $5}' | awk -F: '{print $(NF-1)}' | sort | uniq -c | sort -n
else
        echo "Counting connections in the $TYPEFILTER state by IP address:"
        netstat -an | egrep "^tcp|^udp" | grep -i "$TYPEFILTER" | awk '{print $5}' | awk -F: '{print $(NF-1)}' | sort | uniq -c | sort -n
fi