Connections by TCP Port
This DTrace one-liner counts inbound TCP connections by local TCP port:
# dtrace -n 'tcp:::accept-established { @[args[3]->tcps_lport] = count(); }'
dtrace: description 'tcp:::state-change' matched 1 probes
^C
40648 1
22 3
The preceding output shows there were 3 TCP connections for port 22 ssh
, a single TCP connection for port 40648 (an RPC port).