This command helps you detect the number of connections that one ip has to a (linux) server. Useful for detected ddos attack:

1

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n