I see these two commands that counts the number of connections to the server. However, there is large difference in the output of these two.
To calculate and count, number of connection currently established from each IP address with server.
$ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n | wc -l
154
To Print ESTABLISHED connections instead of all connections, and displays the connections count for each IP
$ netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | wc -l
62
I would like to know what is unestablished connections then (154-62)?