Find IP addresses with a lot of open connections:
netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n

Source:
http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html