Shulou(Shulou.com)06/02 Report--

Requirements: server http with more concurrent connections will be rejected with iptables.

Train of thought:

1. First count the current number of http connections through netstat (redirect the number of connections and connection IP to / root/black.txt if there are more than 3 connections)

2. Write whitelist IP to / root/white.txt (prevent iptables from rejecting some normally requested IP later)

3. Run the command awk'{print $2}'/ root/black.txt to get the IP address with too many printing connections.

4. Define a variable dropip whose type is an array

5. The values in the circular array (${dropip [@]} represents all values of the array subscript)

6. Action "reject IP$ {var}" / bin/true has been commented out by me, mainly for debugging.

[root@linux-node8 test] # cat iptables.sh

#! / bin/bash

#

. / etc/init.d/functions

Httpcc= `netstat-aon | grep "172.2.0.68 grep 80" | grep "ffff" | awk'{print $5}'| cut-d ":"-f 4 | sort | uniq-c | awk'$1 > 3 {printf $1 "\ t" $2 "\ n"}'> / root/ black.txt`

Sleep 6

Dropip= (`awk'{print $2}'/ root/ black.txt`)

For var in ${dropip [@]}

Do

Grep "$var" / root/white.txt & > / dev/null

[$?-ne 0] & & {

Iptables-I INPUT-p tcp-s $var-j DROP

Echo "iptables-I INPUT-p tcp-s $var-j DROP" > > / root/deny_ip.log

# action "reject IP$ {var}" / bin/true

Sleep 3

}

Done

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.