Top connections script

[the_rock]

This script outputs top 100 connections going through the firewall. I also tested it on one of clients' machines and was accurate. Below is example from my lab fw:

[Expert@CP-GW:0]# ./top_active_connections.sh
=== Top 100 active src->dst connections (count) [MODE=translated] ===
1 8.8.8.8 172.16.10.249 udp 53 58134
1 8.8.8.8 172.16.10.249 udp 53 28748
1 8.8.4.4 172.16.10.249 udp 53 36331
1 8.8.4.4 172.16.10.249 tcp 53 15181
1 213.186.33.3 172.16.10.249 tcp 80 10000
1 2.16.170.175 172.16.10.249 tcp 80 10001
1 2.16.170.175 172.16.10.249 tcp 80 10000
1 18.67.39.18 172.16.10.249 tcp 443 10000
1 172.16.10.252 172.16.10.249 tcp 52779 18192
1 172.16.10.252 172.16.10.249 tcp 51373 18192
1 172.16.10.252 172.16.10.249 tcp 257 60243
1 172.16.10.252 172.16.10.249 tcp 257 46513
1 172.16.10.252 172.16.10.249 tcp 257 37583
1 172.16.10.249 8.8.8.8 udp 62528 53
1 172.16.10.249 8.8.8.8 udp 33198 53
1 172.16.10.249 8.8.4.4 udp 35754 53
1 172.16.10.249 8.8.4.4 tcp 38070 53
1 172.16.10.249 213.186.33.3 tcp 62720 80
1 172.16.10.249 2.16.170.175 tcp 47004 80
1 172.16.10.249 2.16.170.175 tcp 47000 80
1 172.16.10.249 18.67.39.18 tcp 61298 443
1 172.16.10.249 172.16.10.252 tcp 60243 257
1 172.16.10.249 172.16.10.252 tcp 46513 257
1 172.16.10.249 172.16.10.252 tcp 37583 257
1 172.16.10.249 172.16.10.252 tcp 18192 52779
1 172.16.10.249 172.16.10.252 tcp 18192 51373
1 172.16.10.249 100.65.16.4 tcp 22 55221
1 172.16.10.249 100.65.16.4 tcp 22 54898
1 172.16.10.249 1.1.1.1 udp 64128 53
1 172.16.10.249 1.1.1.1 tcp 51706 53
1 172.16.10.231 224.0.0.18 vrrp 0 0
1 100.65.16.4 172.16.10.249 tcp 55221 22
1 100.65.16.4 172.16.10.249 tcp 54898 22
1 1.1.1.1 172.16.10.249 udp 53 12250
1 1.1.1.1 172.16.10.249 tcp 53 16131

=== Top 100 active sources (count) [MODE=translated] ===
17 172.16.10.249
5 172.16.10.252
2 8.8.8.8
2 8.8.4.4
2 2.16.170.175
2 100.65.16.4
2 1.1.1.1
1 213.186.33.3
1 18.67.39.18
1 172.16.10.231

=== Top 100 active destinations (count) [MODE=translated] ===
17 172.16.10.249
5 172.16.10.252
2 8.8.8.8
2 8.8.4.4
2 2.16.170.175
2 100.65.16.4
2 1.1.1.1
1 224.0.0.18
1 213.186.33.3
1 18.67.39.18
[Expert@CP-GW:0]#