How can I list the number of connections per client on the FORWARD chain of an OpenWRT router?

I know how to list the number of connections per IP address on the router:

netstat -ntu | tail -n +3 |       # list open TCP and UDP connections
awk '{print $5}' | cut -d: -f1 |  # extract client IP addresses
sort | uniq -c | sort -nr         # show number of occurrences and sort by it

I want to do the same with connections that are going through the router's FORWARD chain.

  • why the -1? can you explain? Commented Jun 21, 2011 at 8:40
  • 1
    The fact that your questions are barely understandable probably doesn't help. I've done major rewrites to your last few, please look at the edits to see what I did. Don't worry so much about examples, they often just confuse things because your example aren't doing the right things. Focus on asking clear questions without abbreviations. If say something, then later feel like you have to say "I mean...", it you should just fix the first statement to use clear English. Sorry I don't know the answer to this question, but good luck, and I hope the edited version helps.
    – Caleb
    Commented Jun 21, 2011 at 15:36
  • @Caleb: Your edited question didn't make sense (it went: I know how to do X, how do I do X?) I've edited in turn; I think my version is what Lance intended, but that's always hard to tell. Repeating something in different words in case is actually a good idea, the problem here is that both versions were so vague. Commented Jun 21, 2011 at 21:43
  • There seems to be two parts to your question: listing the connections, and extracting the information. You seem to only have a problem with the first part though. So including that whole script only made your question even harder to understand. And if you include a script like that, you definitely need to explain it, otherwise each reader has to first decode it (which requires familiarity with both netstat's output and text processing utilities). When you write questions, think of how people might or might not understand them. Commented Jun 21, 2011 at 21:46
  • @Gilles: You're right I goobered the last line. The question in the first line was right and really I think that's the only part of this that is relevant at all, but the contradiction in the edit didn't help :)
    – Caleb
    Commented Jun 21, 2011 at 21:52

1 Answer 1


If I understand your question correctly (which is always dubious with your questions), this isn't possible. Forwarding doesn't keep any state: the router receives a packet, analyses it, sends it onwards to its next destination, and forgets what the packet was. You can count or log packets, but you can't keep track of connections at that level.

It would make sense to count current NAT connections. All the connections that the netfilter subsystem keeps track of are listed in /proc/net/ip_conntrack. You can extract the client address with

sed -ne 's/^.*src=\([^ ]*\).*/\1/p' /proc/net/ip_conntrack

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .