1780 connections from one IP

Applications Cybersecurity
1

Hello, one US IP having 1700+ connections when doing:

netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

1780 *
... *
... *

i want to ask how to debug what this IP does?

2

(The grep is a bit loose.) Maybe it is a proxy, router or firewall. A proxy hides and handles many users' browser connections. A common home/wifi router uses one IP for all the 192.168.*.* hosts behind it. A firewall can support several kinds of proxy-like features. OF course, a browser not using http/1.0 persistent can have many connections, but they are transient.

3

thx, question remains: "i want to ask how to debug what this IP does?"

4

Well, what is it doing? Connecting to your apache? Check your logs.