How to see ip's connected during an attack

Just curiosity, connected to what service? Asking because it is possible to rate limit number of connections (TCP SYN) per IP using iptables.