Shulou(Shulou.com)06/03 Report--

According to the number of web logs or network connections, monitor when the number of concurrent connections to a certain IP reaches 100 or within a period of time, and use firewall commands to block the corresponding IP, every 3 minutes; the firewall command is: iptables-An INPUT-s 192.168.0.7-j DROP

Check the firewall iptables-L-n

The first kind: monitoring log

#! / bin/sh

While true

Do

Cat access_log.dms | awk'{print $1}'| sort | uniq-c | sort-nr > a.log

Exec < a.log

While read line

Do

Pv=$ (echo $line | awk'{print $1}')

Ip=$ (echo $line | awk'{print $2}')

If [$pv-gt 1000] & & [iptables-L-n | grep "$ip" | wc-l-eq 0]; then

Iptables-An INPUT-s $ip-j DROP

Fi

Done

Sleep 180

Done

Description:

How to read and write documents in while

1) cat al.log | while read line

Do

Done

2) execa.log

Netstat command

-a (all) shows all options, but does not show LISTEN correlation by default

-t (tcp) displays only tcp related options

-u (udp) shows only udp related options

-n refuses to display aliases and can show that all numbers are converted into numbers.

-l lists only the status of services in Listen (monitoring)

-p displays the name of the program that established the relevant link

-r displays routing information, routing table

-e displays extended information, such as uid, etc.

-s statistics based on each protocol

-c execute the netstat command at regular intervals.

Tip: the status of LISTEN and LISTENING can only be seen with-an or-l

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.