What is the normal amount of connections you should see with netstat per IP?

[longpiperp]

So, in ubuntu 18.04 i noticed using:

netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r

It will show me a list of current connects and the number of connections. I see some users carry 2,3,4,5 connections is this normal? What should I be looking for when I suspect ddos?

Thanks