The following methods to prevent CC attacks are mainly used to filter access logs and seal the IP address into the firewall. Place the script in cron once every 10 minutes. You can also modify the script as needed, because I use lighttp as a web server, it reads lighttp access logs. This script is also applicable to apache servers:
#! /Bin/bash
/Www/MTCC/solution_ip.sh
/Usr/bin/tail-1000/var/log/lighttpd/access. log | grep-v 127.0.0.1 | awk {print $1} | awk $1 {++ S [$1]} END {for (a in S) print, S [a]} | sort-k 2-n-r | awk $2> 10 {print $1}>/www/MTCC/block_ip.txt
/Www/MTCC/block_ip.sh
#! /Bin/bash
For blockIp in 'cat/www/MTCC/block_ip.txt'
Do
Echo "Blocking... $ blockIp"
/Sbin/iptables-I IPTABLES 4-s $ blockIp-j REJECT
Done
# Iptables-a input-s $1-j REJECT
#! /Bin/bash
/Usr/bin/tail-1000/var/log/lighttpd/access. log | grep-v 127.0.0.1 | awk {print $1} | awk $1 {++ S [$1]} END {for (a in S) print, S [a]} | sort-k 2-n-r | awk $2> 10 {print $1, $2}