Quick check for a ddos via number of connectionsCreated OnOctober 25, 2020byHugh Le You are here: KB Home Quick check for a ddos via number of connections < Back A quick and usefull command for checking if a server is under ddos is: netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n That will list the IPs taking the most amount of connections to a server.