Howto? Established connections [SRC - DST]

Comments

• Nyr Community Contributor, Veteran

  May 2014

  Yeah. Use awk '{print $4 $5}' to read both columns and then you can sort them in groups if you want (so you count same source+destination).

  If you want to count them separately and then show the tops, read two variables using a separator. A space would do for what you want, I suppose.
  IFS='separator' read destination source < <(echo "$extractedcolumns")

  Then you can use $destinationand $source as you wish.

  The upstream can get you a nice log of flows for sure, too.

  Sorry for the fast explanation, but I really need to catch some sleep now :P

  Thanked by 1jmginer
• black Member

  May 2014

  Try

  netstat -ntu | tr -s " " | cut -d " " -f4,5 | sed "s/\:.* / /; s/\:.*$//" | grep -E "^[0-9]" 

  then do all your sort uniq stuff.

  Thanked by 1jmginer
• BluBoy Member

  May 2014

  How specific to do you need the output?

  netstat -ntu | awk '{print $4" -> "$5}'

  Thanked by 1jmginer
• jmginer Member, Host Rep

  May 2014 edited May 2014

  Thanks all, with netstat the problem is not found

  netstat -ntu | tr -s " " | cut -d " " -f4,5 | sed "s/\:.* / /; s/\:.*$//" | grep -E "^[0-9]" | sort | uniq -c | sort -n

  I found with the conntrack-tools and found the hacker. Very interesting this tool

  You can download here or directly running this:

  cd ~; yum install unzip -y; wget https://ginernet.com/downloads/conntrack-tools.zip; unzip conntrack-tools.zip; cd conntrack-tools; rpm -Uhv *;

  Then run "conntrack -L" to found the hacker...

  and solve running:

  conntrack -D -p tcp --dst "hacked-IP"