A quick one-liner to show the IP addresses with an established connection to your server, sorted in order:
netstat -ant | grep ESTABLISHED | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -nr
If you care only about a certain TCP port, say 80 for web traffic, the command becomes:
netstat -ant | grep :80 | grep ESTABLISHED | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -nr
Output would look like:
36 14.21.23.10
8 14.21.23.107
7 14.21.23.114
6 14.21.2.34
5 14.21.23.108
5 14.21.23.106
5
2 14.21.13.120
1 14.21.2.23
1 14.21.13.147
1 14.21.13.130
1 14.21.13.128
1 14.21.13.122
1 14.21.13.118
1 14.21.13.112
