The quickest way to find brute force attackers on a server using Netstat

Step 1.

Identify the bastard:

netstat -an | grep ':443' | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

Step 2.

Use the firewall to block their shite. But make sure it’s legit first by examining the correct log file.