Rank remote IPs by established TCP connection count
Build a paste-ready command, then review its compatibility and effects before running it.
ss -Hnt state established | awk '{print $5}' | sed -E 's/^\[?([^]]+)\]?:[0-9]+$/\1/' | sort | uniq -c | sort -nr | head -<count>Complete required fields to copy the generated command.
read-onlyno known side effects Compatibility
LinuxVerified for Linux using bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementsssss must be installed and available on PATH.
Version supportss Current supported releasesVerified for linux using bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signals148 10.24.7.18Representative successful output; values vary with the selected target and system state.
Known errorsss: command not foundss is missing or is not available on PATH.
Verifyss -Hnt state established | awk '{print $5}' | sed -E 's/^\[?([^]]+)\]?:[0-9]+$/\1/' | sort | uniq -c | sort -nr | head -{{count}}The output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01ssCommandRuns the ss stage of this one-liner.
02-HntOptionConfigures ss with the -Hnt option.
03stateArgumentPasses state to ss.
04establishedArgumentPasses established to ss.
05|PipelinePasses the output on the left to the command on the right.
06awkCommandRuns the awk stage of this one-liner.
07'{print $5}'ArgumentPasses '{print $5}' to awk.
08|PipelinePasses the output on the left to the command on the right.
09sedCommandRuns the sed stage of this one-liner.
10-EOptionConfigures sed with the -E option.
11's/^\[?([^]]+)\]?:[0-9]+$/\1/'ArgumentPasses 's/^\[?([^]]+)\]?:[0-9]+$/\1/' to sed.
12|PipelinePasses the output on the left to the command on the right.
13sortCommandRuns the sort stage of this one-liner.
14|PipelinePasses the output on the left to the command on the right.
15uniqCommandRuns the uniq stage of this one-liner.
16-cOptionConfigures uniq with the -c option.
17|PipelinePasses the output on the left to the command on the right.
18sortCommandRuns the sort stage of this one-liner.
19-nrOptionConfigures sort with the -nr option.
20|PipelinePasses the output on the left to the command on the right.
21headCommandRuns the head stage of this one-liner.
22-<count>OptionConfigures head with the -<count> option.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
ss -Hnt state established | awk '{print $5}' | sed -E 's/^\[?([^]]+)\]?:[0-9]+$/\1/' | sort | uniq -c | sort -nr | head -5
Example output
148 10.24.7.18
92 10.24.3.11
31 2001:db8::42
Illustrative output — exact values vary by system and data.
Official sources