How to Find and Check Number of Connections to a Server November 13, 2008

Whenever a client connects to a server via network, a connection is established and opened on the system. On a busy high load server, the number of connections connected to the server can be run into large amount till hundreds if not thousands. Find out and get a list of connections on the server by each node, client or IP address is useful for system scaling planning, and in most cases, detect and determine whether a web server is under DoS or DDoS attack (Distributed Denial of Service), where an IP sends large amount of connections to the server. To check connection numbers on the server, administrators and webmasters can make use of netstat command.

Below is some of the example a typically use command syntax for ‘netstat’ to check and show the number of connections a server has. Users can also use ‘man netstat’ command to get detailed netstat help and manual where there are lots of configurable options and flags to get meaningful lists and results.

netstat -na
Display all active Internet connections to the servers and only established connections are included.

netstat -an | grep :80 | sort

Show only active Internet connections to the server at port 80 and sort the results. Useful in detecting single flood by allowing users to recognize many connections coming from one IP.

netstat -n -p|grep SYN_REC | wc -l
Let users know how many active SYNC_REC are occurring and happening on the server. The number should be pretty low, preferably less than 5. On DoS attack incident or mail bombed, the number can jump to twins. However, the value always depends on system, so a high value may be average in another server.

netstat -n -p | grep SYN_REC | sort -u
List out the all IP addresses involved instead of just count.

netstat -n -p | grep SYN_REC | awk ‘{print $5}’ | awk -F: ‘{print $1}’
List all the unique IP addresses of the node that are sending SYN_REC connection status.

netstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
Use netstat command to calculate and count the number of connections each IP address makes to the server.

netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
List count of number of connections the IPs are connected to the server using TCP or UDP protocol.

netstat -ntu | grep ESTAB | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -nr
Check on ESTABLISHED connections instead of all connections, and displays the connections count for each IP.

netstat -plan|grep :80|awk {‘print $5′}|cut -d: -f 1|sort|uniq -c|sort -nk 1
Show and list IP address and its connection count that connect to port 80 on the server. Port 80 is used mainly by HTTP web page request.

(sursa: http://www.mydigitallife.info/2007/12/13/how-to-find-and-check-number-of-connections-to-a-server/)

Current connections to SQL Server November 13, 2008

There are a few system functions for returning the number of connections but,they are many times misunderstood.

@@CONNECTIONS : Returns login attempts since the server was started.
@@MAX_CONNECTIONS: Returns maximum number of connections supported.

The simplest way to list all users and processes is to use the system stored procedure: sp_who
To list all active users: sp_who ‘active’
to list details about a particular user: sp_who ‘login-name’
Now to obtain the current number of connections to the server, you can use:

SELECT COUNT(*) AS CONNECTIONS FROM master..sysprocesses

And just to get the user connections, omitting the system processes, use:

SELECT cntr_value AS User_Connections FROM master..sysperfinfo as p
WHERE p.object_name = ‘SQLServer:General Statistics’ And p.counter_name = ‘User Connections’

To see current number of connection for each db in overall:
SELECT db_name(dbid) AS db, count(dbid) AS connection FROM sys.sysprocesses WHERE dbid > 0 GROUP BY dbid