Check the network port traffic with the top 10 traffic large IP

#!/bin/bash   #显示菜单 (radio) Display_menu () {local soft=$1local prompt= "which ${soft}  You ' d select:  ' eval local arr= (\${${soft}_arr[@]}) while truedo     echo -e  "#################### ${soft} setting ####################\n\n"      for  ((i=1;i<=${#arr [@]};i++ )); do echo -e  "$i)  ${arr[ $i-1]} "; done    echo    read -p " ${prompt} "  $soft     eval local select=\$ $soft     if [  "$select"  ==  ""  ] | |  [  "${arr[$soft-1]}"  ==  "  ];then         prompt= "input errors,please input a number: "     else         eval  $soft =${arr[$soft -1]}        eval echo  "your selection: \$ $soft"                       break     fidone}  #把带宽bit单位转换为人类可读单位bit_to_human_readable () {     #input  bit  value    local trafficvalue=$1     if [[ ${ trafficvalue%.*} -gt 922 ]];then         #conv  to  kb        trafficvalue= ' awk -v value= $trafficValue   ' begin{printf  '%0.1f ', value/1024} '         if [[  ${trafficvalue%.*} -gt 922 ]];then              #conv  to Mb             Trafficvalue= ' Awk -v value= $trafficValue   ' begin{printf  '%0.1f ', value/1024} '              echo  "${TRAFFICVALUE}MB"          else            echo  "${trafficValue}Kb"         fi    else         echo  "${trafficvalue}b"     fi}  #判断包管理工具check_package_manager () {    local manager=$1    local systempackage= '      if cat /etc/issue | grep -q -E -i  "Ubuntu|debian"; then         systempackage= ' apt '     elif cat  /etc/issue | grep -q -e -i  "Centos|red hat|redhat";then         syStempackage= ' Yum '     elif cat /proc/version | grep -q -e  -i  "Ubuntu|debian"; then        systempackage= ' apt '      elif cat /proc/version | grep -q -E -i  "centos|red  hat|redhat "; then        systempackage= ' Yum '      else        echo  "Unkonw"     fi      if [  "$manager"  ==  "$systemPackage"  ];then         return 0    else         return 1    fi   }   #实时流量realTimeTraffic () {     local eth= ""     local nic_arr= (' ifconfig |  grep -e -o  "^[a-z0-9]+ " | grep -v " Lo " | uniq ')     local niclen=${#nic_arr [@ ]}    if [[  $nicLen  -eq 0 ]]; then         echo  "Sorry,i can not detect any network device, Please report this issue to author. "         exit 1    elif [[  $nicLen  -eq 1 ]]; then        eth= $nic _arr     else        display_menu nic         eth= $nic     fi         Local clear=true    local eth_in_peak=0    local eth_ out_peak=0    local eth_in=0    local eth_out=0     while true;do          #移动光标到0:0 location         printf  "\033[0;0h"           #清屏并打印Now  peak        [[   $clear  == true ]] && printf  "\033[2j"  && echo   "$eth--------now--------Peak-----------"         traffic_be= (' awk  -v eth= $eth  -f ' [:  ]+ '   ' {if  ($0 ~eth) {print $3,$11}} '  /proc/net/ Dev ')         sleep 2         traffic_af= (' awk -v eth= $eth  -f ' [:  ]+ '   ' {if  ($0 ~eth) {print $3,$ One}} '  /proc/net/dev ')          #计算速率          eth_in=$ ((  (${traffic_af[0]}-${traffic_be[0]}) (*8/2 ))         eth_out=$ ((   (${traffic_af[1]}-${traffic_be[1]}) *8/2 )          #计算流量峰值         [[  $eth _in -gt  $eth _in_peak ]] & & eth_in_peak= $eth _in        [[  $eth _out -gt $ eth_out_peak ]] && eth_out_peak= $eth _out          #移动光标到2:1        printf  "\033[2;1h"           #清除当前行         printf  "\033[k"             printf  "%-20s %-20s\n"   "receive:   $ (bit_to_human_readable  $eth _in) " " $ (bit_to_human_readable  $eth _in_peak) "          #清除当前行         printf  "\033[k"          printf  "%-20s %-20s\n"   "transmit: $ (bit_to_human_readable $ Eth_out) " " $ (bit_to_human_readable  $eth _out_peak) "        [[   $clear  == true ]] && clear=false    done} # Overview of traffic and Connections Trafficandconnectionoverview () {    if ! which tcpdump >  /dev/null;then        echo  "Tcpdump not found, Going to install it. "         if check_package_manager apt;then             apt-get -y install tcpdump         elif check_package_manager yum;then            yum -y install tcpdump         fi    fi     local reg= ""      local eth= ""     local nic_arr= (' Ifconfig | grep  -E -o  "^[a-z0-9]+"  | grep -v  "Lo"  | uniq ')      local niclen=${#nic_arr [@]}    if [[  $nicLen  -eq 0 ]];  then        echo  "Sorry,i can not detect  any network device,please report this issue to author. "         exit 1    elif [[  $nicLen  -eq 1 ]]; then        eth= $nic _arr     else     &Nbsp;  display_menu nic        eth= $nic      fi     echo  "please wait for 10s to  Generate network data     echo     #当前流量值      local traffic_be= (' awk -v eth= $eth  -f ' [:  ]+ '   ' {if  ($0 ~eth {print $3,$11}} '  /proc/net/dev ')      #tcpdump监听网络     tcpdump  -v -i  $eth  -tnn > /tmp/tcpdump_temp 2>&1 &     sleep 10    clear    kill  ' ps aux |  grep tcpdump | grep -v grep | awk  ' {print $2} '       #处理tcpdump文件     awk  '/^ip/{print;getline;print} '  /tmp/tcpdump_temp  > /tmp/tcpdump_temp2    awk  ' {len= $NF; sub (/\)/, "", Len); Getline;print $0,len} '  /tmp/tcpdump_ temp2 > /tmp/tcpdump     #10s后流量值     local traffic_af = (' awk -v eth= $eth  -f ' [:  ]+ '   ' {if  ($0 ~eth) {print $3,$11}} '  /proc /net/dev ')      #打印10s平均速率     local eth_in=$ (  (${traffic_af[0 ]}-${traffic_be[0] (*8/10 ))     local eth_out=$ (  (${traffic_af[1]}-${ TRAFFIC_BE[1] (*8/10 ))     echo -e  "\033[32mnetwork device  $eth  average traffic in 10s: \033[0m "    echo " $eth  receive :  $ (bit_to_human_readable  $eth _in)/S "    echo " $eth  transmit: $ ( bit_to_human_readable  $eth _out)/S "    echo     #统计每个端口在10s内的平均流量     regtcpdump=$ (ifconfig | grep -a 1  $eth  | awk -f ' [:  ]+ '   ' $ ~/inet addr:/{printf $4 "|"} '  | sed -e  ' s/|$//'  -e  ' s/^/(/'  -e  ' s/$/) \\\\\. [0-9]+:/')     echo -e  "\033[32maverage traffic in 10s base  on server port: \033[0m "    awk -f" [ .:]+ '  -v  regtcpdump= $regTcpdump   ' {if  ($0 ~ regtcpdump) {line= "clients > " $8 "." $9 "." $ "." $11 ":" $12}else{line=$2 "." $ "." $4 "." $ ":" $6 " > clients"};sum[line]+= $NF *8/10}end{for  (line in sum) {printf  "%s  %d\n ", Line,sum[line]}} '  /tmp/tcpdump |     sort -k 4 - nr | head -n 10 | while read a b c d;do         echo  "$a   $b   $c  $ (bit_to_human_readable  $d)/S "    done    echo    echo  -e  "\033[32maverage traffic in 10s base on client port: \ 033[0m "    awk -f" [ .:]+ '  -v regtcpdump= $regTcpdump   ' {if  ($  ~ regtcpdump) {line=$2 ".") $ "." $4 "." $ ":" $6 " > server"}else{line= "server > " $8 "." $9 "." $ "." $11 ":" $12};sum[line]+= $NF *8/10}end{for  (line in sum) {printf  "%s %d\n", Line,sum[line]} } '  /tmp/tcpdump |     sort -k 4 -nr | head -n  10 | while read a b c d;do             echo  "$a   $b   $c  $ (bit_to_human_readable  $d)/S"      done                echo     #统计在10s内占用带宽最大的前10个ip     echo -e  "\033[32mtop  10 ip average traffic in 10s : \033[0m "    awk -f" [ .:]+ '  -v regtcpdump= $regTcpdump   ' {if  ($0 ~ regtcpdump) {line=$2 '. $ "." $4 "." $ " > " $8 "." $9 "." $ "." $11 ":" $12}else{line=$2 "." $ "." $4 "." $ ":" $6 " > " $8 "." $9 "." $ "." $11};sum[line]+= $NF *8/10}end{for  (line in sum) {printf  "%s %d\n", Line,sum[line]}} '  /tmp/tcpdump |     sort -k 4 -nr | head -n  10 | while read a b c d;do         echo  "$a   $b   $c  $ (bit_to_human_readable  $d)/S"     done     echo     #统计连接状态     regss=$ (ifconfig | grep  -A 1  $eth  | awk -f ' [:  ]+ '   ' $0~/inet addr:/{printf $4 ' | '} '  | sed -e  ' s/|$//')     ss -an | grep -v -e   "listen| Unconn " | grep -E " $regSS " > /tmp/ss    echo -e   "\033[32mconnection state count: \033[0m"     awk  ' nr>1{sum[$ ( NF-4)]+=1}end{for  (state in sum) {print state,sum[state]}} '  /tmp/ss | sort  -k 2 -nr    echo     #统计各端口连接状态      echo -e  "\033[32mconnection state count by port: \033[0m"      awk  ' nr>1{sum[$ (NF-4), $ (NF-1)]+=1}end{for  (key in sum) {split (KEY,SUBKEY,SUBSEP); PRINT&NBSP;SUBKEY[1],SUBKEY[2],SUM[SUBKEY[1],SUBKEY[2]}} '  /tmp/ss | sort -k 3 - Nr | head -n 10       echo    # The top 10 ip    echo -e  "\033[32mtop 10 ip estab with the statistics port of 80 and the highest status estab connections  state count at port 80: \033[0m "    cat /tmp/ss |  grep estab | awk -f ' [:  ]+ '   ' {sum[$ (NF-2)]+=1}end{for  (ip in  sum) {Print ip,sum[ip]}} '  | sort -k 2 -nr | head -n 10     echo     #统计端口为80且状态为SYN the top 10-RECV connections to the highest number of ip     echo -e  "\033[32MTOP&NBSP;10&NBSP;IP&NBSP;SYN-RECV&NBSP;STATE&NBSP;COUNT&NBSP;AT&NBSP;PORT&NBSP;80:  \033[0m "    cat /tmp/ss | grep -E " $regSS " | grep  syn-recv | awk -f ' [:  ]+ '   ' {sum[$ (NF-2)]+=1}end{for  (ip in sum) { PRINT&NBSP;IP,SUM[IP]}} '  | sort -K 2 -nr | head -n 10} main () {    while true;  do        echo -e  "1)  real time traffic.\n2)  traffic and connection overview.\n "        read  -p  "Please input your select (ie 1): "  select         case   $select  in          &NBSP;&NBSP;&NBSP;1)  realTimeTraffic;break;; &NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;2)  trafficAndConnectionOverview; break;;             *)  echo  "Input error, Please input a number. ";;         esac    done   } main

This article is from the "Smurf Linux ops" blog, so be sure to keep this source http://jin771998569.blog.51cto.com/2147853/1587726

Check the network port traffic with the top 10 traffic large IP