<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>RedHatVN Network &#187; check for a ddos</title>
	<atom:link href="http://redhatvn.net/tag/check-for-a-ddos/feed" rel="self" type="application/rss+xml" />
	<link>http://redhatvn.net</link>
	<description>Shared Linux problems</description>
	<lastBuildDate>Mon, 31 Oct 2011 07:10:57 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>Shell Script List All Top IP Address Accessing Apache / Lighttpd Web Server</title>
		<link>http://redhatvn.net/shell-script-list-all-top-ip-address-accessing-apache-lighttpd-web-server</link>
		<comments>http://redhatvn.net/shell-script-list-all-top-ip-address-accessing-apache-lighttpd-web-server#comments</comments>
		<pubDate>Mon, 14 Dec 2009 03:45:39 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Centos]]></category>
		<category><![CDATA[Cpanel]]></category>
		<category><![CDATA[Directadmin]]></category>
		<category><![CDATA[Linux]]></category>
		<category><![CDATA[shell script]]></category>
		<category><![CDATA[vps]]></category>
		<category><![CDATA[Apache]]></category>
		<category><![CDATA[check for a ddos]]></category>
		<category><![CDATA[Lighttpd]]></category>

		<guid isPermaLink="false">http://redhatvn.net/?p=870</guid>
		<description><![CDATA[#!/bin/bash # Shell Script To List All Top Hitting IP Address to your webserver. # This may be useful to catch spammers and scrappers. # &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;- # This script is licensed under GNU GPL version 2.0 or above # &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;- # where to store final report? DEST=/var/www/reports/ips # domain name DOM=$1 # log file location [...]]]></description>
			<content:encoded><![CDATA[<div class="google_plus_one"><g:plusone size="medium" count="true" url="http://redhatvn.net/shell-script-list-all-top-ip-address-accessing-apache-lighttpd-web-server"></g:plusone></div><blockquote><p>#!/bin/bash<br />
# Shell Script To List All Top Hitting IP Address to your webserver.<br />
# This may be useful to catch spammers and scrappers.<br />
# &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;-<br />
# This script is licensed under GNU GPL version 2.0 or above<br />
# &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;-<br />
# where to store final report?<br />
<span style="color: #008000;">DEST</span>=/var/www/reports/ips</p>
<p># domain name<br />
<span style="color: #008000;">DOM</span>=$1</p>
<p># log file location<br />
<span style="color: #008000;">LOGFILE</span>=/var/logs/httpd/$<span style="color: #008000;">DOM</span>/access.log</p>
<p># die if no domain name given<br />
<span style="color: #ff00ff;">[</span> $# -eq 0 <span style="color: #ff00ff;">]</span> &amp;&amp; <span style="color: #ff6600;">exit</span> 1</p>
<p># make dir<br />
<span style="color: #ff00ff;">[</span> ! -d $<span style="color: #008000;">DEST</span> <span style="color: #ff00ff;">]</span> &amp;&amp; <span style="color: #ff6600;">mkdir</span> -p $<span style="color: #008000;">DEST</span></p>
<p># ok, go though log file and create report<br />
if <span style="color: #ff00ff;">[</span> -f $<span style="color: #008000;">LOGFILE</span> <span style="color: #ff00ff;">]</span><br />
then<br />
<span style="color: #ff6600;">echo</span> &#8220;Processing log for $<span style="color: #008000;">DOM</span>&#8230;&#8221;<br />
<span style="color: #ff6600;">awk</span> &#8216;{ <span style="color: #ff6600;">print</span> $1}&#8217; $<span style="color: #008000;">LOGFILE</span> | <span style="color: #ff6600;">sort</span> | <span style="color: #ff6600;">uniq</span> -c  | <span style="color: #ff6600;"> sort</span> -nr &gt; $<span style="color: #008000;">DEST</span>/$<span style="color: #008000;">DOM</span>.txt<br />
<span style="color: #ff6600;">echo</span> &#8220;Report written to $<span style="color: #008000;">DEST</span>/$<span style="color: #008000;">DOM</span>.txt&#8221;<br />
fi</p></blockquote>
<p><span id="more-870"></span></p>
<h2>How do I run this script?</h2>
<p>Simply run it as follows:<br />
<code>./script website.com</code><br />
Sample output (1st coloum is counter and 2nd is IP address):</p>
<blockquote><p>600 72.30.87.116<br />
50 66.249.71.138<br />
10 66.249.71.140<br />
5 66.249.71.139<br />
3 74.86.49.130</p></blockquote>
]]></content:encoded>
			<wfw:commentRss>http://redhatvn.net/shell-script-list-all-top-ip-address-accessing-apache-lighttpd-web-server/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Quick check for a ddos via number of connections</title>
		<link>http://redhatvn.net/quick-check-for-a-ddos-via-number-of-connections</link>
		<comments>http://redhatvn.net/quick-check-for-a-ddos-via-number-of-connections#comments</comments>
		<pubDate>Fri, 31 Jul 2009 17:14:04 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[check for a ddos]]></category>

		<guid isPermaLink="false">http://redhatvn.net/?p=48</guid>
		<description><![CDATA[A quick and usefull command for checking if a server is under ddos is: netstat -anp &#124;grep &#8216;tcp\&#124;udp&#8217; &#124; awk &#8216;{print $5}&#8217; &#124; cut -d: -f1 &#124; sort &#124; uniq -c &#124; sort -n That will list the IPs taking the most amount of connections to a server. It is important to remember that the [...]]]></description>
			<content:encoded><![CDATA[<div class="google_plus_one"><g:plusone size="medium" count="true" url="http://redhatvn.net/quick-check-for-a-ddos-via-number-of-connections"></g:plusone></div><div>
<p>A quick and usefull command for checking if a server is under ddos is:</p>
<p>netstat -anp |grep &#8216;tcp\|udp&#8217; | awk &#8216;{print $5}&#8217; | cut -d: -f1 | sort | uniq -c | sort -n</p>
<p>That will list the IPs taking the most amount of connections to a server. It is important to remember that the ddos is becoming more sophistcated and they are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.</p></div>
]]></content:encoded>
			<wfw:commentRss>http://redhatvn.net/quick-check-for-a-ddos-via-number-of-connections/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
<!-- WP Super Cache is installed but broken. The path to wp-cache-phase1.php in wp-content/advanced-cache.php must be fixed! -->
