I am trying to block IPs that have many port 25 connections (spam)
I have the following command:
netstat -an|grep :25| awk {'print $4'} | cut -d: -f1 | sort | uniq -c | sort -n
That produces output like:
1
1 127.0.0.1
2 185.11.11.11
10 185.11.11.22
20 185.11.11.33
50 185.11.11.44
And i would like to filter only the rows where column one is bigger than 15.
Thank you
If you don't need the total number of connections but just the list of IPs, this line will do:
netstat -an | awk '$4~/:25/{gsub(":25","",$4); s[$4]++; if(s[$4]==15){print $4}}'
$4~/:25/ filters lines that contain ':25' (equivalent to the grep in your line)
gsub(":25","",$4) removes the port number from the IP address (field 4)
s[$4]++ increases the counter for the given IP
if(s[$4]==15){print $4} prints the IP if the count equals 15
awk can handle most of the things thus you can avoid so many piped commands. You can eliminate all the commands with single gnu-awk command like this:
netstat -an | awk 'BEGIN { PROCINFO["sorted_in"] = "@val_num_desc" }
$4 ~ /:25$/ && split($4, a, ":") == 2 {
seen[a[1]]++
}
END {
for (i in seen)
if (seen[i] > 15)
print seen[i], i
}'
Breakup:
PROCINFO["sorted_in"] = "@val_num_desc" # used for sorting an array by value
# in numerical descending order
split # used to get IP address by discarding port num
$4 ~ /:25$/ # to search a particular port in netstat output
Just append a pipe with awk '$1>15':
netstat -an|grep :25| awk {'print $4'} | cut -d: -f1 | sort | uniq -c | sort -n | awk '$1>15'
The command netstat -an | head -n 4 produces this output here:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:715 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:2137 0.0.0.0:* LISTEN
Which means that field number 4 is "Local Adress". I will assume that what you want is the list of "Foreign Address" (field #5).
Also, you are showing Version 4 IP addresses. Probably a netstat -4an would work better for you. IPv6 addresses should have a variable amount of :.
With those two issues cleared, awk itself could do (almost) all the work:
netstat -4an |
awk ' $5 ~ /:25/ {split($5,a,/:/); c[a[1]]++;}
END{ for (ip in c) { if (c[ip] > 15) print(c[ip],ip) }; }
'|sort -n
Yet another answer.
netstat -nat | awk -F'[ :]+' '
BEGIN{PROCINFO["sorted_in"] = "@val_num_desc"}
$5 == "25" {count[$4]++}
END{
for (ip in count)
if (count[ip]>15)
print count[ip], ip
}
'
