Android created Gist

linux-bash-ddos-block

#!/bin/bash

counter=0
IFS=$'\n'
for input in $(netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | grep -v [a-z])
do
connections=$(echo $input | cut -d " " -f1)
source=$(echo $input | cut -d " " -f2)
if [ $connections -gt 50 ]
then
iptables -A INPUT -s $source -j DROP
echo "$source added to iptables on $(date)" >> /root/ban.txt
counter=$[ counter + 1 ]
fi
done
if [ $counter -gt 0 ]
then
service iptables save
service httpd restart
fi