Mitigate Small DOS Attacks . Script to check IP connections along with Location.

This script will check the last 10 highest number of IP connections and will give the location of the IP address with connections more than 50.

root@xxxx [~]# cat checkddos

#!/bin/bash

###################################################
# Script Name :checkddos
# Created By : Jino Joseph
# Created Date : 01-Jul-2013
# Last Modified : 01-Jul-2013
# Purpose : Finds the IPs with connections higher than 50 show the ip location
###################################################

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head -10 | sed -e 's/^[ \t]*//' | sed -e 's/ /#/g' > result.txt
for i in `cat result.txt`;
do
echo $i > temp.txt;
No=$(cat temp.txt | gawk -F '#' '{print $1}');
IP=$(cat temp.txt | gawk -F '#' '{print $2}');
Num=${No/\.*}
if [ $Num -gt 50 ] && [ $IP != '127.0.0.1' ]
then

echo -e " $IP : $Num \n "
url="http://www.ipaddresslocation.org/ip-address-locator.php?lookup="
lynx -dump $url$IP > tmpfile.txt
cat /root/tmpfile.txt | sed -n '/IP Country:/,/IP Region/p'
rm /root/tmpfile.txt

else
echo "Normal connections : $Num";
fi
done



You can execute the script by ./checkddos. Before that make sure you have given execute permission to the script by the command
# chmod +x checkddos

The result will be like below:

root@xxxx[~]# ./checkddos
14.98.178.42 : 101

IP Country: India [in.png]
IP Country Code: IND
IP Continent: Asia
IP Region: Delhi
Normal connections : 47
Normal connections : 32
Normal connections : 15
Normal connections : 11
Normal connections : 10
Normal connections : 8
Normal connections : 7
Normal connections : 5
Normal connections : 5


You can integrate this with my StopDdosAttack script for blocking these ips.

:-)