https://blog.liuts.com/index.php zh-cn https://blog.liuts.com/post/101/ root <admin@yourname.com> Thu, 22 May 2008 08:43:34 +0000 https://blog.liuts.com/post/101/ #!/bin/sh /bin/netstat -na|grep ESTABLISHED|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -rn|head -10|grep -v -E '192.168|127.0'|awk '{if ($2!=null && $1>4) {print $2}}'>/tmp/dropip for i in $(cat /tmp/dropip) do         /sbin/iptables -A INPUT -s $i -j DROP         echo "$i kill at `date`">>/var/log/ddos done
比较简单，但很实用：）
Tags - ddos ]]> https://blog.liuts.com/post/101/#blogcomment146 高进波 <admin@gaojinbo.com> Thu, 19 Aug 2010 01:26:27 +0000 https://blog.liuts.com/post/101/#blogcomment146
要是对脚本有个详细的说明就好了。。

awk '{if ($2!=null && $1>4) {print $2}}'  这个$1 > 4会不会设置太小了，有时候同一ip的有效连接不只4个 ]]> https://blog.liuts.com/post/101/#blogcomment580 prometheus <user@domain.com> Tue, 15 Feb 2011 07:41:29 +0000 https://blog.liuts.com/post/101/#blogcomment580 https://blog.liuts.com/post/101/#blogcomment774 卖鸡 <zzwangsh@163.com> Sat, 09 Jul 2011 02:38:35 +0000 https://blog.liuts.com/post/101/#blogcomment774 https://blog.liuts.com/post/101/#blogcomment887 111 <user@domain.com> Tue, 06 Sep 2011 11:43:54 +0000 https://blog.liuts.com/post/101/#blogcomment887 https://blog.liuts.com/post/101/#blogcomment2580 my <983874208@qq.com> Wed, 18 Mar 2015 13:33:30 +0000 https://blog.liuts.com/post/101/#blogcomment2580 https://blog.liuts.com/post/101/#blogcomment2582 xiaobao <user@domain.com> Wed, 25 Mar 2015 09:37:19 +0000 https://blog.liuts.com/post/101/#blogcomment2582