Useful script to track spammers connecting to your server

The netstat command is useful to see who's making connections on your server.  This can be useful if your server is running slowly, and you suspect a spammer / hacker is hammering you with connections. 

Here's a useful perl script that shows you the netstat output and lists the top IP addresses that are connecting.  You can then research each IP and see if you need to block it or not.

#!/usr/bin/perl
#This runs netstat and prints out teh top connecting IPs - good for debugging a slow machine
$trigger = 5;

open(NET,"netstat |");
while(<NET>) {
  (@fields) = split;
  ($ip) = split(/:/,@fields[4]);
  #print "IP: $ip\n";
  $ipcount{$ip}++;
  print $_;
}
close NET;

print "Top Connecting Addresses:\n\n";
foreach $i (keys %ipcount) {
   if($ipcount{$i} > $trigger) {
     printf "%25s: %d\n",$i,$ipcount{$i};
   }
}