tcpdump -n -c 10000 ip and udp and dst port 123 | cut -d" " -f3 | cut -d. -f1-4 | sort | uniq -c | sort -rn | head
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
10000 packets captured
10853 packets received by filter
13 packets dropped by kernel
4438 46.29.197.7
8 109.252.180.248
7 85.140.117.56
6 37.190.52.246
6 37.190.52.221
6 37.190.52.122
5 79.139.151.131
5 217.66.159.69
4 95.73.157.119
4 85.140.4.138
short time later
time tcpdump -n -c 20000 ip and udp and dst port 123 | cut -d" " -f3 | cut -d. -f1-4 | sort | uniq -c | sort -rn | head
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
20000 packets captured
20901 packets received by filter
0 packets dropped by kernel
23 213.87.144.48
18 95.216.147.216
16 213.87.144.114
15 91.195.204.104
15 213.87.139.39
14 91.195.204.66
14 195.191.175.244
13 119.143.46.115
12 46.138.163.167
12 213.87.139.106
real 0m8.701s
user 0m0.232s
sys 0m0.032s
