Aggregate results from command line on a specific field (e.g. netstat per IP)

To aggregate results from a command line and count number of results for each field, you can combine multiple tools like awk, cut, uniq and sort to obtain the expected results.

For example, if you want to retrieve count of connections opened per IP onto your server, just run:

netstat -ntu | tail -n +3 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

You will get a results like:

      1 127.0.0.1
      1 10.1.2.3
     65 10.1.2.8
     77 10.10.15.12
    114 10.1.3.8
    132 10.10.16.254
    310 192.168.10.1
   3970 10.0.0.254

If you want to aggregate only results on a particular keyword (a port for example), you can also integrate a grep option to filter your results:

netstat -ntu | grep "27017" | tail -n +3 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n