I want to be able to pipe results to a shell script you make, and the shell script will read the results as 1st column number of connections, second column IP. If the number of connections is over 10, the shell script will execute apf -d ip to block that IP. It should block all IPs with over 10 connections. The 10 should be a variable. This is the command I use to generate the output, I have a few commands I use, so this script should be able to handle results piped to it. # netstat -a -n | grep :80 | awk '{print $5}' | sed 's/::ffff://;/^*:/d' | sed 's/:.*//;/^*:/d' |uniq -c |sort -n|awk {'print $2'}|sort -n | uniq -c 1 5 [login to view URL] 6 [login to view URL] 97 [login to view URL] 153 [login to view URL] 100 [login to view URL] 29 [login to view URL] 1 [login to view URL] 38 [login to view URL] 1 [login to view URL] 73 [login to view URL] 227 [login to view URL] 1 [login to view URL] 3 [login to view URL] 2 [login to view URL] 48 [login to view URL] 2 [login to view URL] 2 [login to view URL] 224 [login to view URL] 35 [login to view URL] 2 [login to view URL] 20 [login to view URL] 4 [login to view URL] 9 [login to view URL] 67 [login to view URL] 30 [login to view URL] 2 [login to view URL] 9 [login to view URL] 10 [login to view URL] 3 [login to view URL] 7 [login to view URL] 12 [login to view URL] 2 [login to view URL] 29 [login to view URL] 5 [login to view URL] 21 [login to view URL] 5 [login to view URL] 5 [login to view URL] 4 [login to view URL] 44 [login to view URL] 10 [login to view URL] 72 [login to view URL] 1 [login to view URL] 2 [login to view URL] 4 [login to view URL] 2 [login to view URL] 268 [login to view URL] With your script I should be able to do: netstat -a -n | grep :80 | awk '{print $5}' | sed 's/::ffff://;/^*:/d' | sed 's/:.*//;/^*:/d' |uniq -c |sort -n|awk {'print $2'}|sort -n | uniq -c | [login to view URL]