How can i find a ip of a ddos attack easily with tcpdump.
i know of these commands to print to the screen.
tcpdump -n udp
tcpdump -n tcp |grep S
tcpdump -n icmp

how do i parse them to show the most likley ip of the attack.

i like tcpdump -qn