DDOS cmd line

# This command will show you the list of IP's which have logged in is maximum number of connections to your server.
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
netstat -n | grep :80 |wc –l
netstat -n | grep :80 | grep SYN |wc -l
# The above commands will show the active connections that are open to your server.
# Result of active connections from the first command will vary but if it shows connections more than 500, then you will be definitely having problems. If the result after you fire second command is 100 or above then you are having problems with sync attack.