How to find number of connection from IPs using netstat (DOS attack)

[Savera]

Hi,

Recently I have been trouble as one of the server I have root access was not accessible, it was coming and going. Our network administrator was not available, then I did a search and I found that server must be under DOS attack. I with limited knowledge search internet and found a useful command of netstat from that you can find which IP is making lots of connection , then after finding it, I blocked and server was up and running until out admin fix it permanently.

Here is the command :

Code: [Select]

netstat -n|grep :80|cut -c 45-|cut -f 1 -d ':'|sort|uniq -c|sort -nr|more
It will show you number of connection on port 80 from all IPs, just find one with unusual number of high connection, block it .

Hope it will help others like me, if yes then let me know here