linux下用netstat批量查询封IP-- － 不是很好！

netstat -an | grep -v LISTEN | awk '{print $5}' |grep -v 218.xx.xx.x|sed "s/::ffff://g"|awk 'BEGIN { FS=":" } { Num[$1]++ } END { for(i in Num) if(Num[i]>8) { print i} }' |grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | xargs -i[] iptables -I INPUT -s [] -j DROP

netstat -an | grep -v LISTEN | awk '{print $5}' |grep -v 218.xx.xx.x|sed "s/::ffff://g"|awk 'BEGIN { FS=":" } { Num[$1]++ } END { for(i in Num) if(Num[i]>8) { print i} }'

netstat -an | grep 'SYN_RECV' | awk '{print $5}' |grep -v 218.xx.xx.x|sed "s/::ffff://g"|awk 'BEGIN { FS=":" } { Num[$1]++ } END { for(i in Num) if(Num[i]>0) { print i} }'|grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | xargs -i[] iptables -I INPUT -s [] -j DROP

netstat -an | grep 'LAST_ACK' | awk '{print $5}' |grep -v 218.xx.xx.x|sed "s/::ffff://g"|awk 'BEGIN { FS=":" } { Num[$1]++ } END { for(i in Num) if(Num[i]>0) { print i} }'|grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | xargs -i[] iptables -I INPUT -s [] -j DROP

netstat -an | awk '{print $5}' |grep -v 218.xx.xx.x|sed "s/::ffff://g"|awk 'BEGIN { FS=":" } { Num[$1]++ } END { for(i in Num) if(Num[i]>2) { print i} }'|grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | xargs -i[] iptables -I INPUT -s [] -j DROP

source:http://www.cysyy.com/cuiqingxiangshui-product/2019_1.html