netstat -an -t tcp | grep ":80" | awk '{printf "%sn",$5}' | sort
用此命令可以 列出通过80访问服务器的连接 如下
219.104.87.14:1288
219.154.122.71:1031
219.154.122.71:1032
219.155.199.124:2584
219.162.41.45:50193
219.162.41.45:50206
219.162.41.45:50208
219.162.41.45:50209
219.232.178.165:2032
219.232.178.165:2033
219.237.107.7:1258
219.237.107.7:1259
219.99.12.198:1235
61.116.137.199:1369
61.128.168.62:1959
61.128.190.9:1546
61.128.190.9:1586
61.134.173.152:1512
61.134.47.194:1142
61.134.47.194:1158
61.138.218.140:4840
61.138.218.140:4841
61.139.64.70:1764
61.140.167.10:21054
61.140.167.10:21074
61.140.189.96:2806
61.143.131.166:2021
61.144.129.233:2873
61.144.82.120:1281
61.147.229.214:3620
61.151.17.217:1154
61.151.17.217:1155
61.152.210.131:59121
61.152.210.131:59419
61.171.213.190:39304
61.171.213.190:39321
61.174.135.127:62255
61.175.228.135:43970
61.175.228.135:43972
61.177.115.116:3791
61.177.255.28:21044
61.179.111.131:22537
61.179.111.131:23267
61.179.125.228:19530
61.180.161.241:3869
61.182.39.125:63606
61.183.244.111:38467
61.185.221.146:45303
61.185.221.146:45331
61.185.221.146:45332
61.185.221.146:45362
61.185.221.146:45371
61.187.196.115:21083
61.189.159.130:1758
61.189.181.201:1700
61.189.181.201:1710
61.190.4.143:2514
61.190.4.143:2540
61.191.110.46:1865
61.240.108.10:1081
61.240.108.10:1082
61.48.16.164:9825
61.52.20.250:25616
61.53.183.10:2542
61.54.97.61:1980
62.202.5.238:17123
66.147.154.3:12808

现在我想做一个shell 让系统每1分钟自动杀死出现超过5次的ip请问如何实现？

please using both ksh and unix c++ to do this task, only using ksh it is a little complex. 
or you can only using c++ and using cron job.
C++ program tasks:
1. call once per minute(using unix cron job to do this)
2. using popen() to open the following command
netstat -an -t tcp | grep ":80" | awk '{printf "%sn",$5}' | sort
3. read the result to map in c++ (string is the IP address, int for the IP appears times)
4. go through "map", if count big than 5, then using another popen call or system() call to kill this that process.

One issue in your issue:
==============
Using netstat command you can not get the process id, so how do you want to kill. Even you using 
ps -ef, you still not know which IP using which process id.