java syn攻击程序_应对synflood 攻击的方法

判断synflood 攻击的方法

#netstat –an |grep SYN_RECV |wc –l

上面的结果如如大于400 有可能为synflood攻击。

1、首先开启syncookie 此为6 次握手才建立起来的TCP 连接。此种方法在10M以下的流量还可以。

在redhat5.5以后是默认开启的

#echo 1 > /proc/sys/net/ipv4/tcp_syncookies

2、把syn+ack回应包有5改为3。

#echo 2 > /proc/sys/net/ipv4/synack_retries

#echo 2 > /proc/sys/net/ipv4/tcp_syn_retries

3、增大半地址池：

#echo 4096 >/proc/sys/net/ipv4/tcp_max_syn_backlog = 4096

4、把配置加入配置文件，重启机器配置不会消失

#vim /etc/sysctl.conf 加入下面的配置

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_max_syn_backlog = 4096

net.ipv4.tcp_synack_retries = 2

net.ipv4.tcp_syn_retries = 2

net.ipv4.tcp_rmem = 32768

net.ipv4.tcp_wmem = 32768

#sysctl -p

5、加入防火墙规则 对Iptables 配置(限制接受包和回应包的速度)

iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT

iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit

1/s -j ACCEPT

iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j

ACCEPT

iptables -t filter -A INPUT -p tcp --syn -j DROP

6、

#!/bin/sh

bip=`tail -n 100000access.log | awk ' $9 ~ "/" ' | awk '$11 == "499" || $11 == "301" ' |awk '$12 == "0"|| $12 == "306" '|awk '$13 == "\"-\""'|awk '{print $2}'|sort -n|uniq -c |sort -n|tail -n 100|awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"`

echo "$bip" >> /root/iptables2.txt

for ip in $bip; do

/sbin/iptables -A INPUT -s$ip -j DROP; echo $ip

done

7、#!/bin/sh

bip=`tail -n 1000/usr/local/nginx-rewrite/logs/rewrite.xxx.com| awk ' $9 ~ "/" ' | awk '$11 == "499"' |awk '$12 == "0" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'| awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"`

bip2=`tail -n 1000/usr/local/nginx-rewrite/logs/rewrite.xxx.com| awk ' $9 ~ "/" ' | awk '$11 == "301"' |awk '$12 == "306" || $12 == "185" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'| awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"`

echo "$bip2" >> /root/iptables2.txt

echo "$bip" >> /root/iptables2.txt

for ip in $bip; do

/sbin/iptables -A INPUT -s$ip -j DROP; echo $ip

done

for ip2 in $bip2; do

/sbin/iptables -A INPUT -s$ip2 -j DROP; echo $ip2

done

sleep 15

bip=`tail -n 1000/usr/local/nginx-rewrite/logs/rewrite.xxxx.com| awk ' $9 ~ "/" ' | awk '$11 == "499"' |awk '$12 == "0" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'| awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"`

bip2=`tail -n 1000/usr/local/nginx-rewrite/logs/rewrite.xxxx.com| awk ' $9 ~ "/" ' | awk '$11 == "301"' |awk '$12 == "306" || $12 == "185" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'| awk '{print $2}'|grep -vE "xxx.231.xxx.195|xxx.2xx.40.131"`

echo "$bip2" >> /root/iptables2.txt

echo "$bip" >> /root/iptables2.txt

for ip in $bip; do

/sbin/iptables -A INPUT -s$ip -j DROP; echo $ip

done

for ip2 in $bip2; do

/sbin/iptables -A INPUT -s$ip2 -j DROP; echo $ip2

done

sleep 15

bip=`tail -n 1000/usr/local/nginx-rewrite/logs/rewrite.xxxx.com| awk ' $9 ~ "/" ' | awk '$11 == "499"' |awk '$12 == "0" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'| awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"`

bip2=`tail -n 1000/usr/local/nginx-rewrite/logs/rewrite.xxxx.com| awk ' $9 ~ "/" ' | awk '$11 == "301"' |awk '$12 == "306" || $12 == "185" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'| awk '{print $2}'|grep -vE "xx0.2xx.22.1xx|xx.2xx.xxx.131"`

echo "$bip2" >> /root/iptables2.txt

echo "$bip" >> /root/iptables2.txt

for ip in $bip; do

/sbin/iptables -A INPUT -s$ip -j DROP; echo $ip

done

for ip2 in $bip2; do

/sbin/iptables -A INPUT -s$ip2 -j DROP; echo $ip2

done