Ok here is the deal, I have a command given to me by some systems guy who I cannot get ahold of on the weekend without paying him alot of money to help me. I need to get this done before Monday as I am just getting pummeled by DOS attacks. The comand given was....

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

and when I run it it outputs.....

72 218.171.144.249
87 200.141.18.62
296 201.141.26.64
369 189.135.8.167

From what I was told by the said systems guy this will show me a list of IP's accessing my server and how many instances of each IP there are. What I want the command to do is to just output the IP's that have over 100+ connections (column 1) and display that IP (not column 1) so I can then fwrite that to my deny file. If someone can include how I would incorporate the fwrite command the would just make my day.

Thanks to all the Guru's out there.

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n | awk '{ if ($1 > 100) print $2 }'