[unique IPs accessing HTTPS port] check which IPs are connecting to HTTPS port on a node #bash #shell #tcpdump #awk

tcpdump_unique_ips_accessing_https.sh

#!/usr/bin/env bash

$ tcpdump -i eth0 -nn ip dst host $(hostname --ip-address) and tcp dst port 443 and src net not 10.0.0.0/16 | awk '{ ts = gensub(/([0-9]+:[0-9]+:[0-9]+.[0-9]+)(.*)/,"\\1","g",$1); ip = gensub(/([0-9]+.[0-9]+.[0-9]+.[0-9]+)(.*)/,"\\1","g",$3); if(!d[ip]) { print ts" "ip; d[ip]=1; fflush(stdout) } }'