Date: Wed, 25 May 2011 00:09:36 +0200 From: Andy Wodfer <wodfer@gmail.com> To: glarkin@freebsd.org Cc: freebsd-questions <freebsd-questions@freebsd.org> Subject: Re: Urgent: Under attack - need tcpdrop help Message-ID: <BANLkTinzTKzBYtThKQ1TBybfbKEJMR6ruA@mail.gmail.com> In-Reply-To: <4DDC1C89.1030706@FreeBSD.org> References: <BANLkTikGjnh-cfO_dtk=jf6ZVNiY=x8nqw@mail.gmail.com> <4DDC182F.1090404@FreeBSD.org> <BANLkTikmqZ2qPoQLeAYtF0rjd=J4kwUn-A@mail.gmail.com> <4DDC1C89.1030706@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Thanks a lot! That was very helpful!
Things have calmed down now.
However, I was surprised to see how quick the tcp connections came back in
netstat. Have to take a closer look at my firewall I guess.
Cheers!
Andy
On Tue, May 24, 2011 at 11:00 PM, Greg Larkin <glarkin@freebsd.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 5/24/11 4:48 PM, Andy Wodfer wrote:
> > Thanks!
> > That would work on all my servers except this one .. which runs 6.3
> STABLE
> > (due to some old services requiring old software).
> >
> > Any other suggestions?
> >
> > Thanks!
> >
> > Andy
> >
>
> Ok, here goes:
>
> netstat -an | grep ^tcp | grep -v LISTEN | awk '{ print $5 }' | egrep -v
> '^(172\.16|192\.168|127\.0)' | cut -f1-4 -d\. | awk '{ a[$1]++ } END {
> for (i in a) { if (a[i] > 10) { print i; } } }' | xargs -n1 -I % sh -c
> 'sockstat -c | grep %' | awk '{ print $6 " " $7 }' | sed -e 's/:/ /g' -e
> 's/^/tcpdrop /'
>
> Paste that all on one line, and it should print (but not execute!)
> tcpdrop commands for IPs that have more than 10 connections to your
> server. The commands will work on 6.x and later versions of the OS,
> since it doesn't use "tcpdrop -l -a".
>
> If you like the output and want to actually run the tcpdrop commands,
> add "| sh" to the end of the pipeline.
>
> YMMV, because I didn't actually execute the commands. I just printed the
> tcpdrop commands, and they looked good.
>
> Good luck,
> Greg
>
> >
> > On Tue, May 24, 2011 at 10:42 PM, Greg Larkin <glarkin@freebsd.org>
> wrote:
> >
> > On 5/24/11 4:29 PM, Andy Wodfer wrote:
> >>>> Hi,
> >>>> One of my FreeBSD servers is currently being attacked (DDOS) and I'm
> >>>> blocking IP addresses in my firewall. However, there are a large
> number
> > of
> >>>> hung tcp connections and I want them gone.
> >>>>
> >>>> Can anyone help me with a script (command line) that can read a
> netstat
> > -n
> >>>> and tcpdrop all IP addresses that has more than 10 connections or a
> more
> >>>> manual command where I can input an IP and it will drop all
> connections
> > from
> >>>> that IP regardless of port?
> >>>>
> >>>> Thanks in advance!
> >>>>
> >>>> Shell scripting isn't what I'm best at unfortunatly ...
> >>>>
> >>>> Andy
> >
> > Hi Andy,
> >
> > This will drop all connections to/from IP address 192.168.22.22:
> >
> > tcpdrop -l -a | grep 192.168.22.22 | sh
> >
> > Just substitute your desired IP address, and that will do the trick.
> >
> > Good luck,
> > Greg
> >>
> > _______________________________________________
> > freebsd-questions@freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> > To unsubscribe, send any mail to "
> freebsd-questions-unsubscribe@freebsd.org"
>
> - --
> Greg Larkin
>
> http://www.FreeBSD.org/ - The Power To Serve
> http://www.sourcehosting.net/ - Ready. Set. Code.
> http://twitter.com/cpucycle/ - Follow you, follow me
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk3cHIkACgkQ0sRouByUApDFdQCgtAPatfLnJP7/r2d/OBhy/P9T
> VJsAn3mWXgqG4GTa9GzuUuH2pDm4JPbz
> =27Nl
> -----END PGP SIGNATURE-----
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?BANLkTinzTKzBYtThKQ1TBybfbKEJMR6ruA>