#!/usr/bin/perl
#
# Script: conncount
#
# Usage: conncount
#
# Description: A tool for listing all the IPs connected to the server at the moment
#
# Author: Ernest E Teem III
#
# Changelog:
# * 02/07/2017: Ernest E Teem III
# - Initial write
#
# * 2026.07.06: Keith Muska
# - Check local GeoLite databases. If less than 30 days old, use mmdblookup.
# - Else, use https://mojoutils.mjhst.com/whois/country.php?ip=$key
#

if ($ARGV[0] eq "-h") {
        &show_usage;
        exit;
}

if (-e '/usr/share/GeoIP/GeoLite2-Country.mmdb') {
  ## Evaluate the age of the GeoLite2 database.  If older than $max_age days, fall back to mojoutils lookup.
  $now = time();
  chomp($GeoLite2Epoch = qx(mmdblookup -f /usr/share/GeoIP/GeoLite2-Country.mmdb -i 0.0.0.0 -v 2>&1 | grep epoch | awk '{print \$3}'));
  $GeoLite2Age = ($now - $GeoLite2Epoch) / (24 * 60 * 60);

  $max_age = 30;

  if ( $GeoLite2Age <= $max_age ) {
      $GeoProvider = "mmdblookup";
  } else {
    print "\nGeoLite2-Country.mmdb older than $max_age days.\nFalling back to mojoutils.mjhst.com lookup.\nThis will be slower.\nRecommend you update the MaxMind databases.\n\n";
    $GeoProvider = "mojoutils.mjhst.com";
  }
} else {
  print "\nGeoLite2-Country database not found.\nFalling back to mojoutils.mjhst.com lookup.\nThis will be slower.\nRecommend you install the MaxMind databases.\n\n";
  $GeoProvider = "mojoutils.mjhst.com";
}


$port = $ARGV[0];
chomp($port);

$flag = 0;
if ($port ne "") {
        if ($port =~ /[0-9]{1,9}/) {
                $flag = 1;
        }
}

if ($flag == 1) {
        $ipv4 = `netstat --numeric | grep ":$port" | awk '{print \$5}' | awk -F ":" '{print \$(NF-1)}' | sort | uniq -c | sort -n`;
} else {
        $ipv4 = `netstat --numeric | awk '{print \$5}' | awk -F ":" '{print \$(NF-1)}' | sort | uniq -c | sort -n`;
}

@parts = split(/\n/, $ipv4);

foreach $part (@parts) {
        chomp($part);
        $part =~ s/^\s+//gi;
        ($cnt, $ip) = split(/\s+/, $part);
        $nums{$ip} = $cnt;
}

foreach $key (sort hashValueAscendingNum (keys(%nums))) {

        if ($key =~ /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/) {
	    if ($GeoProvider eq "mmdblookup") {
		chomp($geoISO = qx(/usr/bin/mmdblookup -f /usr/share/GeoIP/GeoLite2-Country.mmdb country iso_code -i $key 2>&1 | grep utf | cut -d\\" -f2));
		chomp($geoCountry = qx(/usr/bin/mmdblookup -f /usr/share/GeoIP/GeoLite2-Country.mmdb country names en -i $key 2>&1 | grep utf | cut -d\\" -f2));
		if ( $geoISO eq '' ) { $geodata = "No GeoIP Data found" } else { $geodata = "$geoISO, $geoCountry" };
               	print "$nums{$key}\t$key\t$geodata\n";
            } elsif ($GeoProvider eq "mojoutils.mjhst.com") {
	    	chomp($geodata = qx(curl -s https://mojoutils.mjhst.com/whois/country.php?ip=$key));
	       	print "$nums{$key}\t$key\t$geodata\n";
	    } else {
                print "$nums{$key}\t$key\n";
            }
        }

}

print "\nYou MUST be able to justify any IP blocks that you make!";
print "\nCheck logs, an output of tcpdump, etc. A large connection count iteslf is not a sufficient justification for a block.\n";


exit;

sub hashValueAscendingNum
{
        $nums{$a} <=> $nums{$b};
}

sub show_usage
{
        print "$0 [port]\n\n";
        print "A tool for listing all the IPs connected to the server at the moment.\n";
}