#!/bin/bash
netstat -an|grep SYN_RECV|awk -F' ' '{print $5;}'|awk -F':' '{print $1;}'|sort| uniq -c | sort -nr | head -n $1

$ cat dos_attack.sh
#!/bin/bash

netstat -an|grep SYN_RECV|awk -F' ' '{print $5;}'|awk -F':' '{print $1;}'|sort| uniq -c | sort -nr | head -n $1|awk -F' ' '{print $2}'|xargs --replace=TTT /sbin/iptables -t filter -I INPUT 1 -m state --state NEW -m tcp -p tcp -s TTT --dport 80 -j REJECT --reject-with icmp-host-prohibited

$ cat nst.sh

#!/bin/bash

if [[ "1" != "1$1" ]]; then
    netstat -an|grep $1|awk -F' ' '{print $5;}'|awk -F':' '{print $1;}'|sort| uniq -c | sort -nr | head -n 10
else
    netstat -an|awk -F' ' '{print $5;}'|awk -F':' '{print $1;}'|sort| uniq -c | sort -nr | head -n 10
fi