Re all the threads on this 'DoS' issue... Netflow analysis is often better for many this type of toplists than netstat / ss and other tools shipped with any given base OS. Even a proper tcpdump / packet filter log can be better.