This command is using several command line utilities to gather information about the current network connections on a Linux or Unix-based system.

netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r

• netstat -ntu: The netstat command is used to display network statistics. The option -n causes it to display numerical addresses instead of trying to determine host names, -t limits the display to TCP connections, and -u limits the display to UDP connections.

• awk '{print $5}': awk is a text-processing tool. This command uses awk to print the 5th field of the output from the netstat command. The fields are separated by spaces, so this will print the IP address of the remote host for each connection.

• cut -d: -f1 -s: cut is used to remove sections from each line of input. This command is using cut to remove the colon and everything after it from each IP address, resulting in the IP address of the remote host without the port number.

• sort: The sort command is used to sort the list of IP addresses in lexicographic order.

• uniq -c: uniq command is used to filter out repeating lines in a file. The option -c causes it to prefix each line of output with the number of times it occurred in the input.

• sort -nk1 -r: The sort command is used again, this time sorting the list of IP addresses in descending order by the number of occurrences. The option -n causes it to sort numerically, -k1 sort on the first field, and -r sort in reverse order (i.e. descending).

The output of this command:

# netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq - c|sort -nk1 -r
     13 158.158.56.141
     11 178.158.56.142
     10 169.158.56.140
      8 122.158.56.143
      5 111.234.242.60
      1 198.70.251.44