ip_digest.rb

# Input:  Apache2 access log
# Output: IP Address, and number of access, in descending order
# Use Case: When there are strong reasons to believe that you are being DDOS'ed, you can see the top X IP's that
# access the site, and choose to ban them.

begin
 ips = {} 
 while a = gets.chomp
  ip = a.split(" ")[0]
  #puts ip 
  if !ips.has_key? ip 
    ips[ip] = 0
  else
    ips[ip] += 1
  end

 end


rescue NoMethodError => ex
 #carry on
end

puts ips

puts "There are #{ips.length} addresses"
ip_sorts = []
ips.each_key do |key|
 ip_sorts << {key: key, value: ips[key]}
 #puts "#{key} - #{ips[key]}" 
end

ip_sorts.sort!{|x,y|y[:value] <=> x[:value]}

ip_sorts.each do |ip_sort|
  puts "#{ip_sort[:key]} - #{ip_sort[:value]}"
end