SYN攻击TIME_WAIT防御。

 1 #! /bin/bash
 2 
 3 /bin/netstat -anput | grep TIME_WAIT >time_wait.txt
 4 /bin/cat time_wait.txt |awk ‘{print $5}‘ |awk -F ‘[:]‘ ‘{print $1}‘ |sort|uniq -c |awk ‘{print $2"="$1;}‘ >wait_num.txt
 5 
 6 DEFINE="300"
 7 for i in `/bin/cat  /root/wait_num.txt`
 8 do
 9     IP=`echo $i |awk -F= ‘{print $1}‘`
10     NUM=`echo $i|awk -F= ‘{print $2}‘`
11     if [ $NUM -gt $DEFINE ];then
12         grep $IP /etc/sysconfig/iptables > /dev/null
13         if [ $? -gt 0 ];then
14           /sbin/iptables -I INPUT -s $IP -j DROP
15           echo "`date` $IP($NUM) ----将该IP加入到防火墙中。。。" >> /var/log/scanner.log
16       fi
17     fi
18 done