Linux系统shell脚本实战之解决生产ddos攻击

Posted 2022-05-20 江湖有缘

Linux系统shell脚本实战之解决生产ddos攻击

• 一、脚本于鏊求
• 二、脚本内容
• 三、执行脚本

一、脚本于鏊求

要求屏蔽掉ddos攻击的IP

二、脚本内容

[root@192 scripts]# cat /scripts/ddos_pro.sh 
#!/bin/bash
########################################
#Author:jeven
#time:Thu 19 May 2022 04:41:00 PM CST
#filename:ddos_pro.sh
#Script description:
########################################
DATE=$(date '+%Y%m%H%M') 

if [ ! -f /data/log/drop_ip.log ];then
	touch  /data/log/drop_ip.log
/bin/netstat -na|grep ESTABLISHED|awk 'print $5'|awk -F: 'print $1'|sort|uniq -c|sort -rn|head -10|grep -v -E '192.168|127.0'|awk 'if ($2!=null && $1>4) print $2' >> /data/log/drop_ip.log
        if  [ ! -s /data/log/drop_ip.log ];then
		        echo "the system is normal!——$DATE"  >> /var/log/ddos.log
        else
                        for i in $(cat /data/log/drop_ip.log)
                 	do
		             /sbin/iptables -A input -s $i -j DROP
		             echo "$i kill at $DATE" >> /var/log/ddos.log
                        done
	fi
fi

三、执行脚本

[root@192 scripts]# cat /var/log/ddos.log 
the system is normal!——2022051722
[root@192 scripts]#