maxp/ddos-filter.sh

## ddos-filter.sh

tcpdump -v -n -w attack.log dst port 80 -c 250

tcpdump -nr attack.log |awk '{print $3}' \
|grep -oE '[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}' |sort |uniq -c |sort -rn |head -20

#!/bin/bash
BLOCKDB="ips.txt"
IPS=$(grep -Ev "^#" $BLOCKDB)
for i in $IPS
do
iptables -A INPUT -s $i -j DROP
#.

	tcpdump -v -n -w attack.log dst port 80 -c 250

	tcpdump -nr attack.log \|awk '{print $3}' \
	\|grep -oE '[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}' \|sort \|uniq -c \|sort -rn \|head -20

	#!/bin/bash
	BLOCKDB="ips.txt"
	IPS=$(grep -Ev "^#" $BLOCKDB)
	for i in $IPS
	do
	iptables -A INPUT -s $i -j DROP
	#.