netstat with group by (ip adress)

– netstat -ntu | awk ‘ $5 ~ /^[0-9]/ {print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

netstat has two lines of headers:

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address Foreign Address State

Added a filter in the awk command to remove them

– netstat -ntu | awk ‘ $5 ~ /^[0-9]/ {print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

netstat with group by ip adress

– netstat -ntu | awk ‘ $5 ~ /^(::ffff:|[0-9|])/ { gsub(“::ffff:”,””,$5); print $5}’ | cut -d: -f1 | sort | uniq -c | sort -nr

Same as the rest, but handle IPv6 short IPs. Also, sort in the order that you’re probably looking for.

– netstat -nt | awk -F”:” ‘{print $2}’ | sort | uniq -c

count connections, group by IP and port