Skip to main content

Connection Usage

Learning Focus

By the end of this lesson you will know how to monitor connection usage and detect capacity issues.

Checking Connections

# Count established connections by port
netstat -an | grep ":80.*ESTABLISHED" | wc -l
netstat -an | grep ":443.*ESTABLISHED" | wc -l

# Connection states summary
ss -s

# Per-IP connection count (find heavy users)
netstat -an | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -10

Connection States

StateMeaningConcern
ESTABLISHEDActive connectionNormal
TIME_WAITClosing, waiting for cleanupHigh numbers = many short connections
CLOSE_WAITWaiting for local closeBackend not closing properly
SYN_RECVHandshake in progressHigh numbers = possible SYN flood

Key Takeaways

  • Monitor ESTABLISHED connection counts against your server's maximum limits.
  • High TIME_WAIT counts may indicate keep-alive is too short.
  • High SYN_RECV counts may indicate a SYN flood attack.

What's Next