Ip with more sessions

[ASTRAPI]

Hello

I think i am under a D0s attack and i want to find a way to view which ip have the more connections in my forum so i can block it using my firewall.

?

Thank you

[Bohra]

If u use this command

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

you will know who is connecting and how much

Use http://deflate.medialayer.com/

[ASTRAPI]

I am getting something like this:

9 user ip
13 user ip
25 user ip
33 user ip
36 user ip
101 user ip
120 user ip
121 user ip
123 user ip
141 user ip

So if the number before user ip is the open connections/sessions in my forum is it logical the 141?

I think is too much ....

[Bohra]

Originally Posted by ASTRAPI

I am getting something like this:




So if the number before user ip is the open connections/sessions in my forum is it logical the 141?

I think is too much ....

Sometimes it could up just keep check something above 250 is bad i guess