A while back I was deploying a new high volume TCP application and I was interested in the number of connections from particular hosts I was seeing over a period of time. Who was connecting the most, that kind of thing. This one liner accomplishes that rather well. Replace 70.164.19.160 with your servers IP address and should get a list of top connecting hosts and the number of times each host as connected in ascending order. Alter -c 100 to specify the number of packets to capture. Basically what this does is capture the fist 100 SYN sent to the destination host, extract the send IP, sorts them and then counts the number of SYN packets from each host. Simple but effective. I love one liners like this.
1
| |

