I have a question about linux netstat usage and output results. I'm trying to solve a dilema about why my server is facing communications delays and bottle neck issues, So I started digging and studying and one of the things I needed to know is a full connections list grouped per ip address and count number of stablished connections, so I first got this:

[root@ip-localhost ec2-user]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n



The question, If I make the summatory of the listed quantity of connections per ip I'm not getting a total of 3951, that number also raise to over 44K so, what the final line number without ip address represents? file descriptors? possible internal kernel connections? opened sockets forgot for the system?

I have also a summary of the connetions :

[root@ip-localhost ec2-user]# netstat -ant | awk '{print $6}' | sort | uniq -c | sort -n
   1 established)
   1 Foreign
   4 FIN_WAIT1
1040 LAST_ACK  


note: I had to insert the full output due to get to the point that listed connections aren't totalized at the end of the netstat output. thanks

  • Would you please add more detail? Server type, Apache?, a full paste of your raw netstat into pastebin, for instance? Feb 9, 2016 at 21:25
  • I did it, the output is a list of all ipaddresses and number of active connections, but the stackexchange "rules" for post something forced me to remove huge part of the output, but, let me be more specific : the out put was this: first 80 lines of ipaddreses with only 1 connection stablished then follow like this: ``` 5 5 150 xxx.xx.xx.xx 3951 ``` The last number seems to be a sum of all listed devices but when I did the maths the list showed up 150 connections not 3951, after 40 minutes that number was raised to 44000 and the list sumatory was 1200 Feb 10, 2016 at 2:02
  • so the last number 3951 without ip address what represents?? please type the command I originally posted and check your linux output and tell me what is the last number of your output, the higher number without ipaddress Feb 10, 2016 at 2:08

2 Answers 2


Well I think you should first understand the command netstat before applying awk and cut in the output.

netstat -ntu 

will display all the udp and tcp connections including tcp6. So when you are trying to apply awk & cut on the output of netstat command

netstat -ntu | awk '{print $5}' | cut -d: -f1

the cut command then chose ":" as the delimiter and display the first field.

A tcp v4 connection looks like this

A tcp v6 connection looks like this in netstat output


now when you apply cut with delimiter ":" the output of tcp v4 connection will show you the ip address, but output of tcp v6 will be a blank line. And applying sort|uniq -c will count the blank lines.

If you want to list out all tcp established connections to your web server, try this

netstat -npa | grep pid_of_your_web_server | grep ESTABLISHED  | awk '{print $5}' | awk -F ':' '{print $1}' | sort | uniq -c 

Or all tcp connections related to your web server

netstat -npa | grep pid_of_your_web_server | grep tcp | grep -v LISTEN | awk '{print $5}' | awk -F ':' '{print $1}' | sort | uniq -c

to take a total count of all , without grouping

netstat -npa | grep pid_of_your_web_server | grep tcp | grep -v LISTEN | wc -l

sorry to jump old subject but it is never too late for improvements, Why not use one awk for everything and not waste resources on grep like so:

netstat -npa | awk -F: '/tcp/&&/LISTEN/ {print $1}' | sort | uniq -c

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .