How to determine CC attack commands in Centos

View the number of connections on all port 80

1netstat-nat | grep-I "80" | wc-l

Sort connected IP addresses by number of connections

1netstat-ntu | awk '{print $5}' | cut-d:-f1 | sort | uniq-c | sort-n

View TCP connection status

123456netstat-nat | awk '{print $6}' | sort | uniq-c | sort-rnnetstat-n | awk '/^ tcp/{++ S [$ NF]}; END {for (a in S) print a, S [a]} 'netstat-n | awk'/^ tcp/{++ state [$ NF]}; END {for (key in state) print key, "t ", state [key]} 'netstat-n | awk'/^ tcp/{++ arr [$ NF]}; END {for (k in arr) print k, "t ", arr [k]} 'netstat-n | awk'/^ tcp/{print $ NF} '| sort | uniq-c | sort-rnnetstat-ant | awk' {print $ NF} '| grep-V' [a-z]' | sort | uniq-c

View the 20 IP addresses with the maximum number of connections on port 80

12netstat-anlp | grep80 | greptcp | awk '{print $5}' | awk-F: '{print $1}' | sort | uniq-c | sort-nr | head-n20netstat-ant | awk '/: 80/{split ($5, ip ,":"); + + A [ip [1]} END {for (I in A) print A, I} '| sort-rn | head-n20

Use tcpdump to sniff access to port 80.

1 tcpdump-I eth0-tnn dst port 80-c 1000 | awk-F ". "'{print $1 ". "$2 ". "$3 ". "$4} '| sort | uniq-c | sort-nr | head-20

Find more time_wait connections

1netstat-n | grepTIME_WAIT | awk '{print $5}' | sort | uniq-c | sort-rn | head-n20

Search for many SYN connections

1netstat-an | grepSYN | awk '{print $5}' | awk-F: '{print $1}' | sort | uniq-c | sort-nr | more