Linux / Bash - list users IPs connected to HTTP or HTTPS server

In this short article, we would like to show how to easily display the IPs of all connected users to our HTTP or HTTPS server under Linux (Debian / Ubuntu, etc.).

Quick solution (type in the command line):

xxxxxxxxxx

ss -n state established src :80 or src :443

Where:

• -n causes displaying used ports as numbers (service names are not resolved),
• state established causes displaying only established connections,
• src :80 or src :443 causes displaying only ports: 80 or 443 - ports where we have run our servers.

Example output:

xxxxxxxxxx

Netid    Recv-Q    Send-Q             Local Address:Port                Peer Address:Port

tcp      0         0         [::ffff:68.65.116.154]:443       [::ffff:162.157.22.32]:51164

tcp      0         0         [::ffff:68.65.116.154]:443       [::ffff:141.102.77.33]:58280

tcp      0         0         [::ffff:68.65.116.154]:443     [::ffff:108.163.251.172]:30492

Where:

• Netid - socket type (e.g. TCP, UDP, etc.),
• Recv-Q - number of received packets in the queue,
• Send-Q - number of sent packets in the queue,
• Local Address:Port - local machine address and port,
• Peer Address:Port - remote machine address and port (it indicates connected user IP).

Warning: it is good to do not use netstat command because it is marked as deprecated.

We can monitor connected users with watch -n N command.

xxxxxxxxxx

watch -n 1 ss -a -n state established src :80 or src :443

Where:

• watch -n 1 causes state refreshing once per 1s.