You're absolutely right to point that out. My apologies, there's a flaw in the original script that becomes apparent on some systems or with certain types of connections.

The issue is that the script was looking at all sockets, including ones in a LISTEN state which don't have a "Peer Address." This caused the script to process header lines and other irrelevant data, resulting in the garbage output like Local and [.

The fix is to force the ss command to only show established connections, which guarantees a valid remote IP is present. We also need a better way to handle IPv6 addresses to fix the [ issue.

## Corrected Script

This new version is more robust and should give you the clean output you're looking for.

1. Open the script file again:

   Bash

    

   nano check_connections.sh
   

2. Replace the entire contents with this corrected code:

   Bash

    

   #!/bin/bash
   
   # A safe, corrected script to investigate network connections on a Linux server.
   
   echo "================================================================="
   echo "🔍 Top 20 Connecting Peer IPs (Remote Addresses)"
   echo "================================================================="
   echo "This shows which remote IP addresses have an active connection to your server."
   echo "(Count | IP Address)"
   echo "-----------------------------------------------------------------"
   # What's changed:
   # 1. `grep ESTAB`: This is the key fix. It filters for ESTABLISHED connections only,
   #    ensuring we only process lines that have a valid remote peer IP address.
   # 2. `sed ...`: This command is a more reliable way to remove the port number
   #    from both IPv4 and IPv6 addresses, fixing the stray '[' issue.
   # 3. Dropped 'u' from `ss -ntu`: UDP is connectionless, so 'ESTAB' doesn't apply.
   #    This focuses the search on TCP connections, which are the usual cause of hangs.
   
   ss -nt | grep ESTAB | awk '{print $5}' | sed -e 's/:[^:]*$//' -e 's/\[\|\]//g' | grep -vE '127.0.0.1|0.0.0.0' | sort | uniq -c | sort -nr | head -n 20
   
   echo ""
   echo "================================================================="
   echo "🖥️  Detailed List of All Connections"
   echo "================================================================="
   echo "Shows every active connection (Local <--> Peer) and the program using it."
   echo "-----------------------------------------------------------------"
   ss -tunap
   
   echo ""
   echo "================================================================="
   echo "✅ Script finished. No changes were made to your system."
   echo "================================================================="
   

## Why This Works

• grep ESTAB: This is the most important change. It acts as a filter, ensuring that only lines representing a fully established (ESTAB) connection are processed. This automatically gets rid of listening sockets and the header line, which were causing the bad output.

• sed -e 's/:[^:]*$//' -e 's/\[\|\]//g': This command is a more powerful way to clean up the address. It does two things:

  1. Removes the port number (the last colon and everything after it).

  2. Removes the [ and ] brackets that surround IPv6 addresses.

This corrected script should now reliably show you a clean list of remote IP addresses that are actively connected to your server.

Hmm i wonder what server that could be... maybe AI?

🔍 Top 20 Connecting Peer IPs (Remote Addresses)
=================================================================
This shows which remote IP addresses have an active connection to your server.
(Count | IP Address)
-----------------------------------------------------------------
     14 57.141.2.28
     13 57.141.2.26
     13 57.141.2.25
     13 57.141.2.20
     13 57.141.2.11
     13 57.141.2.1
     12 57.141.2.6
     11 57.141.2.18
     10 57.141.2.27
     10 57.141.2.22
     10 57.141.2.2
      9 57.141.2.23
      9 57.141.2.10
      8 57.141.2.4
      8 57.141.2.30
      8 57.141.2.12
      7 57.141.2.9
      7 57.141.2.7
      7 57.141.2.19
      7 57.141.2.16

Apparently that range is owned by meta / facebook.

ASN    AS32934 - Facebook, Inc.
Hostname    No Hostname
Range    57.141.0.0/24

Now we can just run...

sudo ufw deny from 57.141.2.0/24

thanks for spamming my server with your ai...