Counting Connecting IPs on Port 80 with netstat and ss

Luke Hebert

- 2 minutes read - 342 words

If you need a fast snapshot of which remote IPs are talking to your web server on port 80, these two one-liners do the job without pulling in extra tools. They count unique source addresses and sort the results by frequency, so the busiest clients jump to the top.

What the commands do

Both pipelines follow the same logic:

  1. List all sockets in a numeric, plain format.
  2. Filter for entries that reference port 80.
  3. Extract the remote IP (field 5, stripping the port).
  4. Sort, count duplicates, and order by count.

Using netstat

netstat -plan | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
  • -p shows the owning process.
  • -l limits output to listening sockets (useful if you only want established connections, swap -l for -a or drop it entirely).
  • -n keeps addresses in numeric form so you skip reverse DNS lookups.

Using ss

ss -plan | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

ss is the modern replacement for netstat and is generally faster on systems with thousands of sockets. The flags map one-to-one with the netstat version above.

Reading the output

Each line looks like this:

     42 203.0.113.17
      7 198.51.100.4
      1 192.0.2.99

The first column is the count of connections from that IP, and the second column is the IP itself. A sudden spike from an unfamiliar address is a good reason to check your access logs or firewall rules.

Tips

  • If you only care about established connections, add a state filter:

    ss -plan state established | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

  • For IPv6 addresses the cut -d: -f1 step will truncate the address. In that case, replace the cut step with sed 's/:[0-9]*$//' to strip only the trailing port.

  • Run the command during a known-quiet window to establish a baseline, then compare during an incident to spot new or unusual sources quickly.