miend/tracking.sh

## tracking.sh
tail -n 10000 yourweblog.log|cut -f 1 -d ' '|sort|uniq -c|sort -nr|more
# Take a look at the top IP addresses. If any stand out from the others, those would be the ones to firewall.

netstat -n|grep :80|cut -c 45-|cut -f 1 -d ':'|sort|uniq -c|sort -nr|more
# This will look at the currently active connections to see if there are any IPs connecting to port 80. You might need to alter the cut -c 45- as the IP address may not start at column 45. If someone was doing a UDP flood to your webserver, this would pick it up as well.

#On the off chance that neither of these show any IPs that are excessively out of the norm, you would need to assume that you have a botnet attacking you and would need to look for particular patterns in the logs to see what they are doing. A common attack against wordpress sites is:

GET /index.php? HTTP/1.0
#If you look through the access logs for your website, you might be able to do something like:

cut -f 2 -d '"' yourweblog.log|cut -f 2 -d ' '|sort|uniq -c|sort -nr|more
#which would show you the most commonly hit URLs. You might find that they are hitting a particular script rather than loading the entire site.

cut -f 4 -d '"' yourweblog.log|sort|uniq -c|sort -nr|more
#would allow you to see common UserAgents. It is possible that they are using a single UserAgent in their attack.

#The trick is to find something in common with the attack traffic that doesn't exist in your normal traffic and then filter that through iptables, mod_rewrite or upstream with your webhost. If you are getting hit with Slowloris, Apache 2.2.15 now has the reqtimeout module which allows you to configure some settings to better protect against Slowloris.
	tail -n 10000 yourweblog.log\|cut -f 1 -d ' '\|sort\|uniq -c\|sort -nr\|more
	# Take a look at the top IP addresses. If any stand out from the others, those would be the ones to firewall.

	netstat -n\|grep :80\|cut -c 45-\|cut -f 1 -d ':'\|sort\|uniq -c\|sort -nr\|more
	# This will look at the currently active connections to see if there are any IPs connecting to port 80. You might need to alter the cut -c 45- as the IP address may not start at column 45. If someone was doing a UDP flood to your webserver, this would pick it up as well.

	#On the off chance that neither of these show any IPs that are excessively out of the norm, you would need to assume that you have a botnet attacking you and would need to look for particular patterns in the logs to see what they are doing. A common attack against wordpress sites is:

	GET /index.php? HTTP/1.0
	#If you look through the access logs for your website, you might be able to do something like:

	cut -f 2 -d '"' yourweblog.log\|cut -f 2 -d ' '\|sort\|uniq -c\|sort -nr\|more
	#which would show you the most commonly hit URLs. You might find that they are hitting a particular script rather than loading the entire site.

	cut -f 4 -d '"' yourweblog.log\|sort\|uniq -c\|sort -nr\|more
	#would allow you to see common UserAgents. It is possible that they are using a single UserAgent in their attack.

	#The trick is to find something in common with the attack traffic that doesn't exist in your normal traffic and then filter that through iptables, mod_rewrite or upstream with your webhost. If you are getting hit with Slowloris, Apache 2.2.15 now has the reqtimeout module which allows you to configure some settings to better protect against Slowloris.