Passive protection against DDoS attacks

IP Address

Visitors through the browser normal access to the site, and the number of connections to the server generally no more than 20, we can disable the connection through a script of excessive IP access. The following script enumerates all connections by using the netstat command, and blocks access through iptables if the number of connections is greater than 150 for the highest number of connections:

#!/bin/bash
#writen by Zhuxiaowei on 20160216
#to Ban DDoS
Status= ' Netstat-na|awk ' $ ~/[0-9]+:[0-9]+/{print $} ' |awk-f ': ' {print '} ' |sort-n|uniq-c |sort-n|tail-n 1 ' #取 Number of IP and number of maximum connections
Num= ' echo $status |awk ' {print '} ' #取出次数
Ip= ' echo $status |awk ' {print $} ' #取出IP
esnum=150 #定义同一IP同时连接的次数
Result= ' echo ' $NUM > $ESNUM ' |BC '
if [$sesult = 1]
Then
Echo IP: $IP is-over $NUM, BAN it! >>/ddos_ip.txt
/sbin/iptables-i input-s $IP-j DROP
Fi

This article is from the "night Reading Wit Hope female Ghost" blog, please be sure to keep this source http://more3.blog.51cto.com/9929586/1742455

Passive protection against DDoS attacks