ddos攻击检测脚本

while true
   do
   awk '{h[$1]++}END{for ( p in h ) print p,h[p]}' /var/log/nginx/access.log | sort -nrk2 | head -1 > rizhi.txt
   n=`awk -F "[ ]" '{print $1}' /root/rizhi.txt`
   m=`awk -F "[ ]" '{print $2}' /root/rizhi.txt`
   if [ $m -gt 100 ];then
     echo -e "存在恶意攻击 ip:$n 访问次数:$m"
#     iptables -I INPUT -s "$n" -j DROP
     else
     echo -e "访问次数最多的ip:$n 访问次数共计:$m"
   fi
   break
 sleep 1
done