shell脚本实战之解决生产ddos攻击_防ddos攻击shell

目录

一、脚本要求

二、脚本内容

三、执行脚本

一、脚本要求

要求屏蔽掉ddos攻击的IP

二、脚本内容

[root@192 scripts]# cat /scripts/ddos_pro.sh 
#!/bin/bash
DATE=$(date '+%Y%m%H%M') 
 
if [ ! -f /data/log/drop_ip.log ];then
    touch  /data/log/drop_ip.log
fi
/bin/netstat -na|grep ESTABLISHED|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -rn|head -10|grep -v -E '192.168|127.0'|awk '{if ($2!=null && $1>4) {print $2}}' > /data/log/drop_ip.log
if  [ ! -s /data/log/drop_ip.log ];then
    echo "the system is normal!——$DATE"  >> /var/log/ddos.log
else
    for i in $(cat /data/log/drop_ip.log)
    do
        /sbin/iptables -I input -s $i -j DROP
        echo "$i kill at $DATE" >> /var/log/ddos.log
    done
fi
 

三、执行脚本

[root@192 scripts]# cat /var/log/ddos.log 
the system is normal!
[root@192 scripts]#