How to Check Active Web Server Connections in Linux with ss

Question: How many active connections does my web server have right now?

Try: sudo ss -tn state established '( sport = :80 )' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn

Info: ss -tn lists TCP connections using numeric addresses and ports. Filtering for ESTABLISHED connections on local port 80 isolates active HTTP connections, while awk, cut, sort, and uniq count connections by remote IP address.

Examples:

• $ sudo ss -tn state established '( sport = :443 )' | wc -l  # Count established HTTPS connections
• $ sudo netstat -an | grep :80 | grep ESTABLISHED | wc -l  # Count HTTP connections with legacy netstat
• $ sudo lsof -iTCP:80 -sTCP:ESTABLISHED  # View processes using established HTTP sockets

Note: ss is generally faster and more capable than the legacy netstat. An unusually high number of connections from one IP can indicate aggressive scraping, a misbehaving client, or a possible denial-of-service attack. For IPv6 addresses, avoid simple cut -d: -f1 parsing because IPv6 addresses themselves contain colons.