方法:
tcpdump -i ens32 -tn dst port 80 -c 10 | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr |head -n 10
#-i:指定端口
#-t:在输出的每一行不打印时间戳
#-n:指定协议
#-c:在收到指定数量的分组后,tcpdump就会停止
[root@logstash nginx]# tcpdump -i ens32 -tn dst port 80 -c 10 | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr |head -n 10
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens32, link-type EN10MB (Ethernet), capture size 262144 bytes
10 packets captured
18 packets received by filter
0 packets dropped by kernel
10 IP 192.168.10.1
[root@logstash nginx]#