findlocs.sh

Find country codes of all tcp connections

#!/bin/bash

# 1. ss
# 2. Remove header
# 3. Only print ip
# 4. RegEx away port number
IPS=$(ss --tcp | tail -n +2 | awk '{ print $5 }' | sed -e 's/\(.*\):.*/\1/g')
COUNTRIES=""
for IP in $IPS; do
    # 1. Geoiplookup
    # 2. filter invalid ips and ips that cannot be found
    # 3. Select only country code
    # 4. Remove comma in country code
    COUNTRY=$(geoiplookup $IP | grep -vwE '(can|not)' | awk '{print $4}' | tr ',' ' ')
    COUNTRIES="$COUNTRIES $COUNTRY"
done
echo $COUNTRIES | tr ' ' '\n' | sort | uniq -c