TranslateProject/published/201406/How to verify DDOS attack with netstat command on Linux Terminal.md
wxy a71aa7de9e renamed: 10 Database Tools For Linux Users To Use!.md -> 201406/10 Database Tools For Linux Users To Use!.md
renamed:    10 Linux Platforms Meant For Embedded Systems.md -> 201406/10 Linux Platforms Meant For Embedded Systems.md
	renamed:    20140527 4MLinux 9.0 Beta Is a 55 MB Operating System That Has It All.md -> 201406/20140527 4MLinux 9.0 Beta Is a 55 MB Operating System That Has It All.md
	renamed:    20140527 A Complete Historical Timeline of Linux Evolution.md -> 201406/20140527 A Complete Historical Timeline of Linux Evolution.md
	renamed:    20140528 Setup Backup Server Using Bacula And Webmin On Ubuntu 14.04.md -> 201406/20140528 Setup Backup Server Using Bacula And Webmin On Ubuntu 14.04.md
	renamed:    20140528 Why We Shouldn't Accept Bad Linux Ports.md -> 201406/20140528 Why We Shouldn't Accept Bad Linux Ports.md
	renamed:    20140529 Add Windows Like Bottom Taskbar In Ubuntu Unity 14.04.md -> 201406/20140529 Add Windows Like Bottom Taskbar In Ubuntu Unity 14.04.md
	renamed:    20140529 Command Line Tuesdays--The Introductory.md -> 201406/20140529 Command Line Tuesdays--The Introductory.md
	renamed:    20140529 How To Share Disks In VirtualBox Between Linux Guest OS.md -> 201406/20140529 How To Share Disks In VirtualBox Between Linux Guest OS.md
	renamed:    20140529 Install RainLoop Webmail (A Web Based Email Client) using 'Nginx and Apache' in Arch Linux.md -> 201406/20140529 Install RainLoop Webmail (A Web Based Email Client) using 'Nginx and Apache' in Arch Linux.md
	renamed:    20140529 What is a good terminal emulator on Linux.md -> 201406/20140529 What is a good terminal emulator on Linux.md
	renamed:    20140529 Why No Flash Support for Linux Is Good for Open Source.md -> 201406/20140529 Why No Flash Support for Linux Is Good for Open Source.md
	renamed:    20140530 Fix 'Cannot Add PPA' Error In Ubuntu 14.04 and Linux Mint.md -> 201406/20140530 Fix 'Cannot Add PPA' Error In Ubuntu 14.04 and Linux Mint.md
	renamed:    20140530 How To Install Linux On A MacBook Pro Retina.md -> 201406/20140530 How To Install Linux On A MacBook Pro Retina.md
	renamed:    20140530 Linux script command--A recorder inside your Terminal.md -> 201406/20140530 Linux script command--A recorder inside your Terminal.md
	renamed:    20140603 App Grid Is A Superior Ubuntu Software Center Alternative.md -> 201406/20140603 App Grid Is A Superior Ubuntu Software Center Alternative.md
	renamed:    20140603 Linux Foundation to donate portion of membership fees to Code.org.md -> 201406/20140603 Linux Foundation to donate portion of membership fees to Code.org.md
	renamed:    20140603 Write your first Linux Kernel module.md -> 201406/20140603 Write your first Linux Kernel module.md
	renamed:    20140604 Command line secrets.md -> 201406/20140604 Command line secrets.md
	renamed:    20140604 Setup Virtual Hosts In Apache On Ubuntu 14.04 LTS.md -> 201406/20140604 Setup Virtual Hosts In Apache On Ubuntu 14.04 LTS.md
	renamed:    20140607 Cup 2014 Brazil--Watch FIFA World Cup 2014 Competition in Your Linux Desktop.md -> 201406/20140607 Cup 2014 Brazil--Watch FIFA World Cup 2014 Competition in Your Linux Desktop.md
	renamed:    20140607 How To Extract Images From Videos Using ffmpeg.md -> 201406/20140607 How To Extract Images From Videos Using ffmpeg.md
	renamed:    20140607 How To Install iCup 2014 In Linux.md -> 201406/20140607 How To Install iCup 2014 In Linux.md
	renamed:    20140607 Linux--Bash Delete All Files In Directory Except Few.md -> 201406/20140607 Linux--Bash Delete All Files In Directory Except Few.md
	renamed:    20140607 New OpenSSL breach is no Heartbleed-but needs to be taken seriously.md -> 201406/20140607 New OpenSSL breach is no Heartbleed-but needs to be taken seriously.md
	renamed:    20140607 Nuvola Player 2.4.0 Released -- A Online Cloud Music Player for Linux.md -> 201406/20140607 Nuvola Player 2.4.0 Released -- A Online Cloud Music Player for Linux.md
	renamed:    20140607 Practical Interview Questions and Answers on Linux Shell Scripting.md -> 201406/20140607 Practical Interview Questions and Answers on Linux Shell Scripting.md
	renamed:    20140607 Steam Hits The Big 500 For Linux Games.md -> 201406/20140607 Steam Hits The Big 500 For Linux Games.md
	renamed:    20140607 Ubuntu One Formally Shuts Down.md -> 201406/20140607 Ubuntu One Formally Shuts Down.md
	renamed:    20140609 How To Know If Your System Has USB 3.0 Port In Linux [Quick Tip].md -> 201406/20140609 How To Know If Your System Has USB 3.0 Port In Linux [Quick Tip].md
	renamed:    20140609 Open Source LDAP Solutions.md -> 201406/20140609 Open Source LDAP Solutions.md
	renamed:    "20140609 OpenELEC 4.0.4 \347\216\260\345\267\262\345\217\221\345\270\203, \345\237\272\344\272\216 XBMC 13.1 \342\200\234Gotham\342\200\235.md" -> "201406/20140609 OpenELEC 4.0.4 \347\216\260\345\267\262\345\217\221\345\270\203, \345\237\272\344\272\216 XBMC 13.1 \342\200\234Gotham\342\200\235.md"
	renamed:    20140610 How to set up Internet connection sharing with iptables on Linux.md -> 201406/20140610 How to set up Internet connection sharing with iptables on Linux.md
	renamed:    20140610 IPFire 2.13 Core 78 Linux Firewall OS Receives OpenSSL Fixes.md -> 201406/20140610 IPFire 2.13 Core 78 Linux Firewall OS Receives OpenSSL Fixes.md
	renamed:    20140610 Open Source SDN Project OpenDaylight Adds New Members.md -> 201406/20140610 Open Source SDN Project OpenDaylight Adds New Members.md
	renamed:    20140610 Top 7 Desktop Environment For Linux.md -> 201406/20140610 Top 7 Desktop Environment For Linux.md
	renamed:    20140611 HTG Explains--What' s the Difference Between Linux and BSD.md -> 201406/20140611 HTG Explains--What' s the Difference Between Linux and BSD.md
	renamed:    20140611 How to Prevent Other Users From Accessing Your Home Directory in Ubuntu 14.04.md -> 201406/20140611 How to Prevent Other Users From Accessing Your Home Directory in Ubuntu 14.04.md
	renamed:    20140612 Command Line Tuesdays--Part One.md -> 201406/20140612 Command Line Tuesdays--Part One.md
	renamed:    20140612 Dpkg Vulnerabilities Closed in Ubuntu 14.04.md -> 201406/20140612 Dpkg Vulnerabilities Closed in Ubuntu 14.04.md
	renamed:    20140616 How To Install Numix Icon Theme In Fedora 20.md -> 201406/20140616 How To Install Numix Icon Theme In Fedora 20.md
	renamed:    20140616 Ubuntu Desktop Next 14.10 Images Available to Download.md -> 201406/20140616 Ubuntu Desktop Next 14.10 Images Available to Download.md
	renamed:    20140616 Ubuntu for Phones Activated on 10,000 Devices.md -> 201406/20140616 Ubuntu for Phones Activated on 10,000 Devices.md
	renamed:    20140617 14 Apps To Boost Ubuntu.md -> 201406/20140617 14 Apps To Boost Ubuntu.md
	renamed:    20140619 Improve Battery Life with Laptop Mode Tools 1.65.md -> 201406/20140619 Improve Battery Life with Laptop Mode Tools 1.65.md
	renamed:    20140619 Red Hat to Acquire eNovance, Focus Together on OpenStack.md -> 201406/20140619 Red Hat to Acquire eNovance, Focus Together on OpenStack.md
	renamed:    20140620 Celebrating 30 Years of X.md -> 201406/20140620 Celebrating 30 Years of X.md
	renamed:    20140620 ENCRYPT DNS TRAFFIC IN LINUX WITH DNSCRYPT (VIA OPENDNS).md -> 201406/20140620 ENCRYPT DNS TRAFFIC IN LINUX WITH DNSCRYPT (VIA OPENDNS).md
	renamed:    20140620 How to enable testing and unstable repository on Debian.md -> 201406/20140620 How to enable testing and unstable repository on Debian.md
	renamed:    20140625 Canonical Debuts 'Orange Box' for Ubuntu OpenStack Cloud Demos.md -> 201406/20140625 Canonical Debuts 'Orange Box' for Ubuntu OpenStack Cloud Demos.md
	renamed:    8 examples of findmnt command to check mounted file systems on Linux.md -> 201406/8 examples of findmnt command to check mounted file systems on Linux.md
	renamed:    Bash Getopts--Scripts with Command Line Options.md -> 201406/Bash Getopts--Scripts with Command Line Options.md
	renamed:    Collectl--An Advanced All-in-One Performance Monitoring Tool for Linux.md -> 201406/Collectl--An Advanced All-in-One Performance Monitoring Tool for Linux.md
	renamed:    Fix Adobe Flash Player Issue In Chromium In Ubuntu 14.04.md -> 201406/Fix Adobe Flash Player Issue In Chromium In Ubuntu 14.04.md
	renamed:    Guide To Install Ubuntu 14.04 In Dual Boot Mode With Windows 8 Or 8.1 UEFI.md -> 201406/Guide To Install Ubuntu 14.04 In Dual Boot Mode With Windows 8 Or 8.1 UEFI.md
	renamed:    How To Install 'California' Calendar App in Ubuntu 14.04.md -> 201406/How To Install 'California' Calendar App in Ubuntu 14.04.md
	renamed:    How To Remove Drive Icons From Unity Launcher In Ubuntu 14.04 [Beginner Tips].md -> 201406/How To Remove Drive Icons From Unity Launcher In Ubuntu 14.04 [Beginner Tips].md
	renamed:    How to Install Windows 8.1 and Ubuntu 14.04 LTS on the Same Computer.md -> 201406/How to Install Windows 8.1 and Ubuntu 14.04 LTS on the Same Computer.md
	renamed:    How to download webcomics from the command line on Linux.md -> 201406/How to download webcomics from the command line on Linux.md
	renamed:    How to launch applications differently with Gnome-Pie on Linux desktop.md -> 201406/How to launch applications differently with Gnome-Pie on Linux desktop.md
	renamed:    How to manage Linux containers with Docker on Ubuntu.md -> 201406/How to manage Linux containers with Docker on Ubuntu.md
	renamed:    How to manage ip addresses and subnets with phpIPAM.md -> 201406/How to manage ip addresses and subnets with phpIPAM.md
	renamed:    How to manage passwords from the command line on Linux.md -> 201406/How to manage passwords from the command line on Linux.md
	renamed:    How to monitor Nginx web server from the command line in real time.md -> 201406/How to monitor Nginx web server from the command line in real time.md
	renamed:    How to set up a web-based lightweight system monitor on Linux.md -> 201406/How to set up a web-based lightweight system monitor on Linux.md
	renamed:    How to take a screenshot from the command line on Linux.md -> 201406/How to take a screenshot from the command line on Linux.md
	renamed:    How to take full length screenshots of websites via terminal.md -> 201406/How to take full length screenshots of websites via terminal.md
	renamed:    How to use LVM in Linux.md -> 201406/How to use LVM in Linux.md
	renamed:    How to verify DDOS attack with netstat command on Linux Terminal.md -> 201406/How to verify DDOS attack with netstat command on Linux Terminal.md
	renamed:    Install SoundCloud In Ubuntu 14.04.md -> 201406/Install SoundCloud In Ubuntu 14.04.md
	renamed:    Linux Pros' Top Command Line Secrets.md -> 201406/Linux Pros' Top Command Line Secrets.md
	renamed:    Linux Terminal--Dstat monitoring tools.md -> 201406/Linux Terminal--Dstat monitoring tools.md
	renamed:    Making Linux Feel at Home.md -> 201406/Making Linux Feel at Home.md
	renamed:    Open Source's Cult Of Personality Is Dying--Thankfully.md -> 201406/Open Source's Cult Of Personality Is Dying--Thankfully.md
	renamed:    Pros' Secrets and Red Hat 7 and PCLinuxOS 2014.05 Reviews.md -> 201406/Pros' Secrets and Red Hat 7 and PCLinuxOS 2014.05 Reviews.md
	renamed:    Start Practising Linux ip command and Avoid the Habit of Using ifconfig.md -> 201406/Start Practising Linux ip command and Avoid the Habit of Using ifconfig.md
	renamed:    TechView--Linus Torvalds Inventor of Linux.md -> 201406/TechView--Linus Torvalds Inventor of Linux.md
	renamed:    Turn Off Bluetooth By Default In Ubuntu 14.04 [Quick Tip].md -> 201406/Turn Off Bluetooth By Default In Ubuntu 14.04 [Quick Tip].md
	renamed:    Ubuntu Linux Community Manager Jono Bacon Leaves Canonical.md -> 201406/Ubuntu Linux Community Manager Jono Bacon Leaves Canonical.md
	renamed:    What Heartbleed Teaches Us--Be An Open Source Contributor, Not Just A User.md -> 201406/What Heartbleed Teaches Us--Be An Open Source Contributor, Not Just A User.md
	renamed:    Why htop Command Compete Linux top Command.md -> 201406/Why htop Command Compete Linux top Command.md
2014-06-30 21:53:24 +08:00

79 lines
3.5 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

如何使用netstat命令验证DDOS入侵
================================================================================
一般来说,服务器非常慢可能原因是多方面的,有可能是配置错误,脚本错误或者是一些奇诡的硬件。当然也有可能是有人对你的服务器进行 Dos (拒绝服务攻击)或者 DDOS (分布式拒绝服务攻击)。
Dos攻击或者DDos攻击目的是使服务器或者网络资源耗尽使其他用户无法使用。一般来说这种攻击主要针对重要的网站或服务比如银行、信用卡支付网关甚至是根域名服务器。Dos攻击主要通过强制目标主机重启或大量消耗其主机资源使得目标主机无法提供服务或者妨害主机和用户之间的通信的手段使得主机无法提供正常的服务的。
在本文中你将知道如何在终端中使用netstat命令判断服务器是否遭受Dos攻击。
netstat命令的用户手册描述其作用是用来显示网络连接、路由表、接口统计、伪连接和组播成员的。
### 一些例子和解释 ###
netstat -na
该命令将显示所有活动的网络连接。
netstat -an | grep :80 | sort
显示所有80端口的网络连接并排序。这里的80端口是http端口所以可以用来监控web服务。如果看到同一个IP有大量连接的话就可以判定单点流量攻击了。
netstat -n -p|grep SYN_REC | wc -l
这个命令可以查找出当前服务器有多少个活动的 SYNC_REC 连接。正常来说这个值很小最好小于5。 当有Dos攻击或者邮件炸弹的时候这个值相当的高。尽管如此这个值和系统有很大关系有的服务器值就很高也是正常现象。
netstat -n -p | grep SYN_REC | sort -u
列出所有连接过的IP地址。
netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'
列出所有发送SYN_REC连接节点的IP地址。
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
使用netstat命令计算每个主机连接到本机的连接数。
netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
列出所有连接到本机的UDP或者TCP连接的IP数量。
netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr
检查 ESTABLISHED 连接并且列出每个IP地址的连接数量。
netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
列出所有连接到本机80端口的IP地址和其连接数。80端口一般是用来处理HTTP网页请求。
### 如何减少DOS攻击 ###
一旦你获得攻击服务器的IP地址你就可以使用以下命令拒绝此IP的所有连接。
iptables -A INPUT 1 -s $IPADRESS -j DROP/REJECT
注意,你需要将 $IPADRESS 替换成需要拒绝连接的IP地址。
执行完以上命令后使用以下命令结束所有的httpd连接以清理系统。
killall -KILL httpd
然后执行以下命令重启httpd服务。
service httpd start #RedHat 系统
/etc/init/d/apache2 restart #Debian 系统
--------------------------------------------------------------------------------
via: http://linuxaria.com/howto/how-to-verify-ddos-attack-with-netstat-command-on-linux-terminal
译者:[shipsw](https://github.com/shipsw) 校对:[wxy](https://github.com/wxy)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译,[Linux中国](http://linux.cn/) 荣誉推出