#!/bin/sh

/bin/netstat -na|grep ESTABLISHED|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -rn|head -|grep -v -E '192.168|127.0'|awk '{if ($2!=null && $1>4) {print $2}}'>/home/shell/dropip

for i in $(cat /home/shell/dropip)

do

        /sbin/iptables -I INPUT -s $i -j DROP

#-m limit --limit /min --limit-burst

        echo "$i kill at `date`">>/var/log/ddos

done

#!/bin/sh

## search connection established ips

netstat -an |grep EST|awk -F " " '{print $5}' |cut -d ":" -f4 |grep "[0-9]*.[0-9]*.[0-9]*.[0-9]*" |sort  |uniq -c |sort -rn  |head - >/home/shell/ip_connection.log

## drop ips

cat /home/shell/ip_connection.log |egrep -v "[a-z][A-Z]*" |egrep -v "202.165|192.168|127.0"|while read line

do

    count=`echo $line|awk '{print $1}'`

    ip=`echo $line|awk '{print $2}'`

    if [ $count -ge  ]

      then

         echo "all establish status connection > 100 ip is : $ip"

         echo "apply rule ,drop $ip access 100 !"

         /sbin/iptables -I INPUT  -s $ip -p tcp --dport   -j  DROP

         /sbin/service iptables save

    fi

done