46

I have a webserver, i need to check number of connections in my server at that given time,

i used following 

netstat -anp |grep 80 |wc -l

this returned with 

2542

but from my google analytics's i know that simultaneous users is not more than 100.

is this correct ? 
if not how to i get the active number of connections ? 
is this sign of a victim of DOS attack how do i know that ?
mahen3d
  • 4,342
  • 14
  • 36
  • 57
  • With `ss` you can filter port and state a bit faster: `ss -nt dport == :80 and state connected`. – eckes Dec 09 '17 at 15:32
  • Number of connections is not number of users. Each user browser can open multiple connections at the same time. On the opposite, while more rare, multiple users using the same proxy could appear only through one connection. – Patrick Mevzek Dec 09 '17 at 17:31

5 Answers5

79

Try just counting the ESTABLISHED connections:

netstat -anp | grep :80 | grep ESTABLISHED | wc -l

Also, be careful about not using a colon in your port grep statement. Just looking for 80 can lead to erroneous results from pids and other ports that happen to have the characters 80 in their output.

d34dh0r53
  • 1,781
  • 11
  • 11
  • 8
    `grep -w 80` solves that problem, and eliminates things like `8093`. – Michael Hampton Aug 26 '12 at 09:35
  • 1
    yeah, you're right :80 can possibly introduce false positives as well. – d34dh0r53 Aug 26 '12 at 09:39
  • 1
    @MichaelHampton Both grep -w 80 and :80 will also count outgoing http connections, if any. netstat -ntp|awk '{print $4}'|grep -w 80. And yes, I care too much about the color of the bikeshed :) :) . –  Aug 26 '12 at 12:25
  • This one is lil improved.. _netstat -an | grep -w 80 | grep -i established | awk {'print $5'} | cut -d: -f1 | sort | uniq -c | sort -n_ – user169015 Sep 25 '14 at 04:45
9
ss -tn src :80 or src :443

This will show all connections to the local ports 80 or 443 (add/modify port(s) if needed).

Disclaimer: I realize this is an old question, but it's still the top result at Google, so I think it deserves an answer utilizing modern utilities.

Iskren
  • 221
  • 2
  • 5
6

Taking @d34dh0r53 answer one step "further" (towards an answer with a "broader" perspective), you can also check all the connections sorted according to their state with the following:

netstat -ant | grep :<port_num> | awk '{print $6}' | sort | uniq -c | sort -n

for example:

netstat -ant | grep :8000 | awk '{print $6}' | sort | uniq -c | sort -n

A possible output might be:

1 CLOSING
1 established
1 FIN_WAIT2
1 Foreign
2 CLOSE_WAIT
6 FIN_WAIT1
7 LAST_ACK
7 SYN_RECV
37 ESTABLISHED
44 LISTEN
297 TIME_WAIT

Hope it helps and please rise up any elaborations and/or comments you have on the above.

Cheers,

Guy.

Guy Avraham
  • 171
  • 1
  • 7
2

You could simply put your IP address in there instead of worrying about stringing multiple greps, seds, and awks together.

netstat -anp | grep -c $(hostname -i):80

Using $(hostname -i) will allow the use of this command on any box, static/dynamic IP and so on.

chicks
  • 3,793
  • 10
  • 27
  • 36
Gryd3
  • 21
  • 1
1

This is also done with a modern utility like ss

For example, trying to get all TCP connections established on port 8080

ss -tn src :8080 | grep -i "estab" | wc -l

Min Latt
  • 11
  • 1