n top

Top remote IPs by active connections

Usage — n top

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — top (t, top-ips, conns) — Busiest remote IPs — who's connected most, with reverse DNS
═══════════════════════════════════════════════════════════════════════════════

USAGE:
  n t .                                rank remote IPs by active connections to this machine

Target: . = this machine · <host> = remote
Deeper: n t -h = the concept/theory behind this command

The concept behind it — n top -h

═══════════════════════════════════════════════════════════════════════════════
  NETSCREW GUIDE: Top Remote IP Connections ("n top-ips")
═══════════════════════════════════════════════════════════════════════════════

WHAT THIS DETECTS:
  Audits all active ESTABLISHED TCP connections across the host and aggregates them
  by remote IP address. Automatically performs reverse DNS resolution to reveal
  who is talking to your machine.

WHEN TO USE:
  • Runaway client: A single IP holding dozens or hundreds of open sockets against your host.
  • Active File Transfers: Massive throughput or stream from a media client or backup server.
  • Zombie Connections: Stale remote clients that never closed their connection.

EXAMPLE COMMANDS:
  • n top-ips       Run connection aggregation and reverse DNS resolution