awk — Socket Statistics (ss)

List established connections — local to remote

ss -tn state established | awk 'NR>1 {print $4, "->", $5}'

Count connections per remote IP

ss -tn | awk 'NR>1 {split($5,a,":"); ip[a[1]]++} END{for(i in ip) printf "%-16s %d\n",i,ip[i]}' | sort -k2 -rn

Count connections per state

ss -ta | awk 'NR>1 {state[$1]++} END{for(s in state) printf "%-15s %d\n",s,state[s]}'

Listening ports sorted numerically

ss -tlnp | awk 'NR>1 {split($4,a,":"); print a[length(a)]}' | sort -nu

Processes with the most open sockets

ss -tlnp | awk 'NR>1 {match($0,/users:\(\("([^"]+)"/,m); proc[m[1]]++} END{for(p in proc) printf "%-20s %d\n",p,proc[p]}' | sort -k2 -rn

Convert ss output to CSV

ss -tn | awk 'NR==1{gsub(/ +/,","); print; next} NR>1{printf "%s,%s,%s,%s,%s\n",$1,$2,$3,$4,$5}'