Unix/Linux : Use netstat to find out IP addresses served by your website server

Problem :

You want to know if the real-time connection information served by Google Analytics is accurate and you need to compare with your web server's log. Perhaps, you just want to find out which IP addresses are being served by your website server. How to that in Unix or Linux ?

Solution :

Instead of relying on monitoring log files with tail -f command. You can get real time information on the IP addresses currently being served by your web server.

Use the netstat -tn 2 > /dev/null command to get the Active Internet connections information.

For example :

 $>netstat -tn 2>/dev/null

 Active Internet connections (w/o servers)

 Proto Recv-Q Send-Q Local Address Foreign Address State

 tcp 0 0 162.243.5.230:443 113.102.185.8:55315 SYN_RECV

 tcp 0 0 10.128.221.78:34371 10.128.148.90:3306 TIME_WAIT

 tcp 0 0 127.0.0.1:9000 127.0.0.1:37494 TIME_WAIT

 tcp 0 0 127.0.0.1:9000 127.0.0.1:37496 TIME_WAIT

 tcp 0 0 162.243.5.230:443 212.33.233.43:54942 ESTABLISHED

 tcp 0 0 162.243.5.230:443 212.33.233.43:54951 ESTABLISHED

 tcp 0 0 10.128.221.78:34373 10.128.148.90:3306 TIME_WAIT

 tcp 0 0 162.243.5.230:443 113.102.185.8:55314 ESTABLISHED

 tcp 0 0 162.243.5.230:443 212.33.233.43:54944 ESTABLISHED

However, we need to filter out the connections that are connected to port 80(http) or 443(SSL - https connection). This can be done easily by piping the result from netstat to grep command. Change grep to :80 if your web server is not serving via https/SSL.

 $> netstat -tn 2>/dev/null | grep :443

 tcp 0 0 162.243.5.230:443 113.102.185.8:55315 SYN_RECV

 tcp 0 0 162.243.5.230:443 212.33.233.43:54942 ESTABLISHED

 tcp 0 0 162.243.5.230:443 212.33.233.43:54951 ESTABLISHED

 tcp 0 0 162.243.5.230:443 113.102.185.8:55314 ESTABLISHED

 tcp 0 0 162.243.5.230:443 212.33.233.43:54944 ESTABLISHED

Hope this system administration tip helps!