{"id":986,"date":"2013-01-24T04:36:49","date_gmt":"2013-01-24T10:36:49","guid":{"rendered":"http:\/\/blog.supportpro.com\/?p=986"},"modified":"2026-03-26T22:32:26","modified_gmt":"2026-03-27T04:32:26","slug":"how-to-verify-ddos-attack-with-netstat-command","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/how-to-verify-ddos-attack-with-netstat-command\/","title":{"rendered":"How to verify DDOS attack with netstat command?"},"content":{"rendered":"\n

Denial-of-service attack (DoS attack) or Distributed Denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users. This attack generally target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers. DoS attacks are implemented by either forcing the targeted computer to reset, or consuming its resources so that it can no longer provide its services or obstructs the communication media between the users and the victim so that they can no longer communicate adequately.<\/p>\n\n\n\n

This blog provides you an overview on how to identify DDOS attack using netstat command.<\/p>\n\n\n\n

#netstat -na<\/code><\/pre>\n\n\n\n
Display all active Internet connections to the server and only established connections are included.<\/p>\n\n\n\n
#netstat -an | grep :80 | sort<\/code><\/pre>\n\n\n\n
Show only active Internet connections to the server on port 80 and sort the results. Useful in detecting a single flood by allowing you to recognize many connections coming from one IP.<\/p>\n\n\n\n
#netstat -n -p|grep SYN_REC | wc -l<\/code><\/pre>\n\n\n\n
To find out how many active SYNC_REC are occurring on the server. The number should be pretty low, preferably less than 5. On DoS attack incidents or mail bombs, the number can jump to pretty high. However, the value always depends on system, so a high value may be average on another server.<\/p>\n\n\n\n
#netstat -n -p | grep SYN_REC | sort -u<\/code><\/pre>\n\n\n\n
List all IP addresses involved.<\/p>\n\n\n\n
#netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'<\/code><\/pre>\n\n\n\n
List all the unique IP addresses of the nodes that are sending SYN_REC connection status.<\/p>\n\n\n\n
#netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n<\/code><\/pre>\n\n\n\n
Use netstat command to calculate and count the number of connections each IP address makes to the server.<\/p>\n\n\n\n
#netstat -anp |grep 'tcp\\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n<\/code><\/pre>\n\n\n\n
List the number of connections the IPs are making to the server using TCP or UDP protocol.<\/p>\n\n\n\n
#netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr<\/code><\/pre>\n\n\n\n
Check on ESTABLISHED connections instead of all connections, and display the number of connections for each IP.<\/p>\n\n\n\n
#netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1<\/code><\/pre>\n\n\n\n
Show a list IP addresses and its number of connections that are connecting to port 80 on the server. Port 80 is used mainly by the HTTP protocol.<\/p>\n\n\n\n
If you require help, contact SupportPRO Server Admin<\/a><\/a><\/span><\/span><\/p>\n\n\n\n
\n
Facing issues? <\/p>\n\n\n\n
Our technical support
engineers can solve it. <\/p>\n\n\n\n\"Contact<\/a><\/span>