I have had a few issues with a server recently. So i just wanted to leave a window showing the unique and IP's of connected devices.

I have been using:

watch -n 5 "netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | sed 's/.*::ffff://' | sort | uniq -c | sort -nr"

Here is an example of the output when the formatting fails example Here is a example of the Netstat without formatting enter image description here reason for the confusion, is i am using awk '{print $5}' to print the 5th column only

I am assuming its because i am trying to use watch with pips and something does not agree with the other.

Can anyone suggest a tweak to the one liner, Or can anyone advise of another tool to monitor the active connections to the server (Not interested in local connections)


I would try

... | awk '$5 ~ /:80$/ { split($5,A,":") ; if ( !u[A[1]]++ ) print A[1] ;} '

which should filter on distant IP on port 80.

  • no need to grep | awk | sed !!
  • $5 ~ /:80$/ filter fifth field ending in 80
  • !u[A[1]]++ is valid only once
  • split() will result in IP on A[1] (and port on A[2] ) (at least for pure IPV4 )

to cope with watch like

while true
  netstat -tn 2>/dev/null | awk '$5 ~ /:80$/ { split($5,A,":") ; if ( !u[A[1]]++ ) print A[1] ;} '
  sleep 5
  • -bash: !u[A[1]]++: event not found What does / This do / mean (Sorry for the stupidity) – Dave Hamilton Mar 17 '16 at 16:47
  • this piece of code is only valid inside awk. – Archemar Mar 17 '16 at 16:49
  • This work in the following format: netstat -tn 2>/dev/null | awk '$5 ~ /:80$/ { split($5,A,":") ; if ( !u[A[1]]++ ) prin A[1] ;}' When stacked with Watch it fails to return anything. – Dave Hamilton Mar 17 '16 at 17:00
  • If you use the above command, and you have it wrapped in quotes, Then it will fall over. ! is a command in Bash on its own. And as its in Quotes it wont locate it. So use Single quotes, Or if using watch and you require the double quotes for the watch statement. then ensure you use a tailing slash. ( \!u[A[1]]++ ) – Dave Hamilton Mar 17 '16 at 17:40
  • Thank you, I was considering doing a looping script, but thought it would have been better practise to use the correct tool *watch Marked as answer as this does what i was after. – Dave Hamilton Mar 17 '16 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.