Ip with more sessions

Hello

I think i am under a D0s attack and i want to find a way to view which ip have the more connections in my forum so i can block it using my firewall.

?

Thank you

 

If u use this command

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

you will know who is connecting and how much

Use http://deflate.medialayer.com/

 

I am getting something like this:

So if the number before user ip is the open connections/sessions in my forum is it logical the 141?

I think is too much ....

 

Sometimes it could up just keep check something above 250 is bad i guess