Extract IP from netstat output

Question

The netstat output contains thing like...

tcp        0      0 0.0.0.0:80       221.126.149.99:51973    ESTABLISHED 23879/apache2
tcp        0      0 0.0.0.0:80        66.249.68.154:40883     ESTABLISHED 23899/apache2
tcp        0      0 0.0.0.0:80       66.249.68.81:41200      ESTABLISHED 23892/apache2
tcp        0      0 0.0.0.0:80       66.249.67.121:59355     ESTABLISHED 23905/apache2
tcp        0   4465 0.0.0.0:80       110.75.175.27:48139     ESTABLISHED 23901/apache2

I use this commands

netstat -anpt|grep apache2 |grep ESTABLISHED | awk -F "[ :]" '{print $4}'

I was not able to get the IP, any hints?

score 14 · Accepted Answer · answered Sep 13 '10 at 13:57

14

This will return a list of unique IP address you're connected too:

netstat -anpt | grep apache2 |grep ESTABLISHED | awk '{ print $5 }' | cut -d: -f1 | sort -u

Well I think I need to change my glasses also =P

answered Sep 13 '10 at 13:57

jyz

6,011
3
29
37

Dr. belisarius · Answer 2 · 2010-09-12T14:25:28.217

3

You may try

netstat -anpt|awk 'BEGIN {FS="[ :]+"};/ESTABLISHED/ && /apache/{print $6}'

For some reason I am counting 6 fields, while everybody else is counting 4 ... Should I buy new glasses? :)

HTH!

edited Sep 12 '10 at 14:25

answered Sep 12 '10 at 05:33

Dr. belisarius

60,527
15
115
190

You're not the only one. I'd recommend moving the grep patterns inside awk. – glenn jackman Sep 12 '10 at 11:41
@glenn jackman Agree. Edited. Sometimes, in the well formed questions, when the OP posts his solution, I feel it's better to modify the minimum possible, because it makes the bug easier to understand. May be I'm wrong – Dr. belisarius Sep 12 '10 at 14:31

score 2 · Answer 3 · answered Sep 12 '10 at 05:27

2

You're really close. You just need to change your field separator regular expression so that it's not considering a single whitespace or colon as the field separator:

netstat -anpt|grep apache2 |grep ESTABLISHED | awk -F "[ :]*" '{print $4}'

answered Sep 12 '10 at 05:27

Kaleb Pederson

45,767
19
102
147

score 2 · Answer 4 · answered Sep 12 '10 at 06:24

2

netstat -anpt | awk '/apache2/&&/ESTABLISHED/{sub(/:*/,"",$4);print $4} '

answered Sep 12 '10 at 06:24

ghostdog74

327,991
56
259
343

The awk action should be: `{sub(/:.*/,"",$5);print $5}` – glenn jackman Sep 12 '10 at 11:41
1

why is it $5? I am not using any FS but the default – ghostdog74 Sep 12 '10 at 11:46
It used to be $4, but went up to $5. Inflated code. – Lizz Dec 13 '14 at 09:48

score -1 · Answer 5 · answered Sep 05 '12 at 06:26

-1

 netstat -ant | grep 80 | wc -l

answered Sep 05 '12 at 06:26

mrhassell

125
2

This will count how many 80 listed in the output of 'netstat -ant' command, which is way inaccurate. – Laith Leo Alobaidy Nov 16 '17 at 17:23

Extract IP from netstat output

5 Answers5