Count Unique Connecting Addresses

When you are reviewing access logs or connection records, you often need a fast answer to one question: which addresses are showing up the most? A single pipeline of three standard Unix tools gives you that answer without writing a script.

The Command

awk '{print $1}' <filename> | sort | uniq -c | sort -nk1

Replace <filename> with the path to your log file. The pipeline works in four steps:

1. awk extracts the first field (the connecting address) from every line.
2. sort orders the addresses alphabetically so that uniq can group them.
3. uniq -c collapses consecutive duplicates and prepends a count.
4. sort -nk1 re-sorts the output numerically by the count column, putting the highest counts first.

Example Output

     42 192.168.1.10
     17 10.0.0.5
      3 172.16.4.22
      1 203.0.113.7

Each line shows the number of connections followed by the address that made them.

Tips

• If your log format puts the address in a different column, adjust the awk field number (for example, awk '{print $3}').
• Add | head -20 at the end of the pipeline if you only need the top 20 addresses.
• Pipe through grep first to filter by date range or service name before counting.

This one-liner is a quick way to get a frequency table of connecting addresses without reaching for a full log-analysis tool.

• SysAdmin

• Bash