Skip to content

Instantly share code, notes, and snippets.

@theratman
Last active September 21, 2023 22:53
Show Gist options
  • Save theratman/4bc9d8cacee407d9b781109773f2a472 to your computer and use it in GitHub Desktop.
Save theratman/4bc9d8cacee407d9b781109773f2a472 to your computer and use it in GitHub Desktop.
Show top established IP connections to the ports 80(http) and 443 (https). This scripts use ss (iproute package) and goiplookup to show IP geographic location.
#!/usr/bin/env bash
############################################################
# #
# Usage: ./Established_IP_on_port_80_and_443_v2.sh [all] #
# Show IPs TCP State Established, with argument show all #
# #
############################################################
# Color variables
GREEN='\033[0;32m'
BLUE='\033[0;34m'
MAGENTA='\033[0;35m'
CYAN='\033[0;36m'
CLEAR='\033[0m'
function header() {
if [ -n "${1}" ]; then
echo -e "${BLUE}All State: established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listen and closing${CLEAR}"
else
echo -e "${BLUE}Only State: established (use with argument '${CLEAR}${GREEN}all${CLEAR}${BLUE}' to show all state)${CLEAR}"
fi
echo -e "${MAGENTA}──────────────────────────────────────────────────────${CLEAR}"
echo -e "${MAGENTA} Q IP Country${CLEAR}"
echo -e "${MAGENTA}──────────────────────────────────────────────────────${CLEAR}"
echo -en "${CYAN}"
}
while true; do
clear
if [ $# -gt 0 ]; then
header "${1}"
ss -ant | awk '! /^LISTEN/ {n=split($4, a, ":", seps); if (a[n] == "80" || a[n] == "443") {m=split($5, b, ":", seps); print b[m-1]} }' | sort -V | uniq -c | sort -rn | head -25 | awk '{printf("%s\t-> ", $0); system("/usr/local/bin/goiplookup " $2 " | cut -d\\ -f4-")}'
echo -en "${CLEAR}"
else
header
ss -ant | awk '/^ESTAB/ {n=split($4, a, ":", seps); if (a[n] == "80" || a[n] == "443") {m=split($5, b, ":", seps); print b[m-1]} }' | sort -V | uniq -c | sort -rn | head -25 | awk '{printf("%s\t-> ", $0); system("/usr/local/bin/goiplookup " $2 " | cut -d\\ -f4-")}'
echo -en "${CLEAR}"
fi
sleep 3
done
@theratman
Copy link
Author

Changed from using geoiplookup to goiplookup, also changed from 20 to 25 in reverse order and add colors 🌈 just for fun.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment