title: How to determine number of concurrent session made by Individual IPs
body: <p>I am working on an analyzer script. It is a simple bash script that apply some logic on tcpdump sniffed capture. </p>
  
  <p>My task is to find out number of concurrent sessions made by individual IPs. The logic I have applied is I have counted different source ports request by each ip for same destination IP and port i.e. 3128 as it is a proxy server.</p>
  
  <p>For example, consider my dest ip is 172.31.1.1 and dest port is 3128</p>
  
  <p>Now I have sniffed traffic only limited for this dest port and dest ip.</p>
  
  <p>Then I have filtered out source ip and source port pair for each packet.</p>
  
  <p>then I have counted number of different source port for each source IP and I think that would be equal to number of concurrent sessions made by each individual IP with this proxy server.</p>
  
  <p>Now by looking at the output on a running proxy server for a 10,000 packets sample, number of sessions by each IP goes like 300,250,200 and some less also. For 1 lakh, it goes like 3000,2500 also.</p>
  
  <p>Is there something wrong with my interpretation of sessions as number of concurrent session allowed by firewall is 100 per IP.   </p>