netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
You should get a whole list with a number infront of an ipaddress.
Example list:
1 1.3.3.7
4 69.0.0.69
13 55.55.55.55
88 41.99.0.0
The 1 1.3.3.7 means, 1 connection, ip: 1.3.3.7
The 88 41.99.0.0 means, 88 connections, ip: 41.99.0.0
Same goes for the rest, number connections, then IP address.
If more than 40-50 connections per ip it's a DoS/DDoS attack