0

how can I combine the following command: 

netstat -atun | awk '{print $ 5}' | cut-d: f1 | -e sed '/ ^ $ / d' | sort | uniq-c | sort-n

and "geoiplookup" listing something like "Con. Number, IP, Country"

I am using this lib: http://kbeezie.com/geoiplookup-command-line/

Thank you for your help! best regards

AbsoluteƵERØ
  • 7,816
  • 2
  • 24
  • 35
Capelas
  • 21
  • 1
  • I think your brute-force keyword is what's causing this to be a negative question. You're just trying to determine which countries your traffic is from correct? – AbsoluteƵERØ Sep 07 '14 at 22:20

1 Answers1

0

You should be able to get it with something like this:

netstat -an -f inet | awk '{print $ 5}' | sed -e '/^\*\.\*$/d' | awk 'sub(/\.[0-9]+$/,"")' | uniq | sort -n | xargs -n 1 geoiplookup { } | sort | uniq -c | sort -n | sed -r 's/ GeoIP Country Edition://g'

netstat -an -f inet - shows all network related data structures with network addresses as numbers and pulls the inet address family

awk '{print $ 5}' - takes that input and presents only the ip address with port from the prior.

sed -e '/^\*\.\*$/d' - strips out all of the . lines

awk 'sub(/\.[0-9]+$/,"")' - strips the port number leaving the ip address alone

uniq - gets rid of the duplicate ips

sort -n - performs a numeric sort (not necessary)

xargs -n 1 geoiplookup { } - takes the first input an performs the lookup for the country

sort - sorts based on country name

uniq -c - groups the country names with a count

sort -n - organizes the countries based on the count

sed -r 's/ GeoIP Country Edition://g' - Strips the phrasing "GeoIP Country Edition:"

This has little to do with brute force, other than telling you which country the connections are coming from.

AbsoluteƵERØ
  • 7,816
  • 2
  • 24
  • 35
  • The command is not working correctly for me. Have you tested? Thanks for the support! – Capelas Sep 08 '14 at 10:58
  • This is the best version but put ip on new line: netstat -atun | awk '$5 ~ /^[1-9]/ { print $5}' | cut -d: -f1 | sed -e '/^$/d' | sed -e '/127.0.0.1/d' | sort | uniq -c | sort -n | awk '{print "Ligacoes: "$1" IP:"$2" - Pais:"; $pais=system("geoiplookup "$2)}' – Capelas Sep 08 '14 at 16:30
  • I tested it on MacOS but didn't load it into any of my other boxes. Yeah I was wondering why you weren't keeping the IP? – AbsoluteƵERØ Sep 09 '14 at 00:20