SxNetstat 2.1: analyse TCP connections by IP address

SxNetstat

SxNetstat is a GPL-licensed Bash tool that turns a Linux server’s TCP connection inventory into an immediately useful ranking of remote IP addresses.

The principle deliberately remains simple: collect connections with ss, or fall back to netstat, cleanly extract IPv4 and IPv6 addresses, count them, then display the most frequent ones. Version 2.1 adds the filters and safeguards needed to make this more than a disposable one-liner.

Usage

With no arguments, SxNetstat displays its help. To display the first ten addresses:

./sxnetstat.sh --number 10

Display the first twenty addresses, or all of them:

./sxnetstat.sh --number 20
./sxnetstat.sh --all

Enable reverse DNS lookups:

./sxnetstat.sh --number 50 --reverse
./sxnetstat.sh --number 50 --reverse-lookup 1

Filter by port and connection direction:

./sxnetstat.sh --all --port 443 --direction out
./sxnetstat.sh --all --port 22 --direction in

With --direction in, the port is matched on the local side; with out, on the remote side; with any, the default, on either side.

IPv4 and IPv6 whitelists

The --whitelist-file option can be repeated. Each file accepts exact addresses and CIDR networks, for both IPv4 and IPv6:

./sxnetstat.sh --all \
  --whitelist-file /etc/sxwall/whitelist.d/local.conf \
  --whitelist-file /etc/sxwall/whitelist.d/partners.conf

Blank lines and comments are ignored. When SxNetstat is run through delegated sudo, it only accepts regular files owned by root, not writable by the group or other users, and genuinely located below /etc/sxwall/whitelist.d. Symbolic links and paths escaping that directory are rejected.

What version 2.1 actually does

– supports ss, with netstat as a fallback;
– correctly parses IPv4 and IPv6 address/port pairs;
– normalises IPv4-mapped IPv6 addresses;
– ranks IP addresses by the number of connections found;
– filters by port and direction;
– combines whitelist files containing addresses and CIDRs;
– performs optional reverse DNS lookups;
– refuses to publish a partial result if the network inventory fails.

The built-in ignore list also removes the most obvious local or special addresses, together with address placeholders used by StackX.

Command-line compatibility

Take care if you used an older release: the old positional arguments are no longer accepted. This is deliberate: explicit options prevent a number, port or switch from being misinterpreted inside an automated script. Use --number, --port, --direction and the other documented options from now on.

Dependencies

SxNetstat uses Bash, awk, sort, uniq, tail, and either ss or netstat. The host command is only required for reverse lookups. Hardened whitelist validation also uses readlink and stat.

Resources

Script: sxnetstat.sh

—
Christophe Casalegno (find all my links, projects and social networks at all.bo)