我也网上参考的例子，但是用perl脚本，我这里没办法执行。代码如下：
#!/usr/bin/perl -w
# Date:2009-03-14
# Author:HyphenWang
# Version:1.3
use strict;
my $IPTABLES_CMD="/sbin/iptables -v -n -x -L FORWARD";
my $BANIP_CMD="/root/banip.sh";
my $SEC="3";
my $ZERO="1";
#my $BANIP="1";
my $BANSEC="60";
#my $HTML="1" if (defined $ARGV[0] and $ARGV[0] eq "-p");
my ($HTML,$BANIP);
my $limit_input_rate=200;
my $limit_output_rate=35;
my @exclude_ip=qw(30 153 155 200 221);
my @vzserver_ip=qw(135);
#@exclude_ip=(@exclude_ip,@vzserver_ip);
push (@exclude_ip,@vzserver_ip);
my (%first_input,%first_output);
my (%second_input,%second_output);
my (%ban_ip,$input_rate,$output_rate);
if (defined $ARGV[0]) {
for (@ARGV) {
$HTML = 1 if $_ eq "-p";
$BANIP = 1 if $_ eq "-b";
}
}
sub get_ipflow {
my ($ip_input,$ip_output)=@_;
for my $line (`$IPTABLES_CMD`) {
my @columns = split(/\s+/,$line);
$ip_input->{$columns[-1]}=$columns[2] if ($columns[3] eq "ACCEPT" and $columns[-1] =~ m/192\.168\.228\.\d+/);
$ip_output->{$columns[-2]}=$columns[2] if ($columns[3] eq "ACCEPT" and $columns[-2] =~ m/192\.168\.228\.\d+/);
$ban_ip{$columns[-1]}=1 if ($columns[3] eq "DROP" and $columns[-1] =~ m/192\.168\.228\.\d+/);
$ban_ip{$columns[-2]}=1 if ($columns[3] eq "DROP" and $columns[-2] =~ m/192\.168\.228\.\d+/);
}
}
get_ipflow(\%first_input,\%first_output);
sleep $SEC;
get_ipflow(\%second_input,\%second_output);
if (! defined $BANIP) {
if (! defined $HTML) {
print "Now is ".localtime()."\n";
print "-"x53,"\n";
print "IP Address\t\tIn Flow Rate\tOut Flow Rate\n";
}
else {
print<<EOF;
<table cellspacing="0">
<tr><td><table border="1" align="left" cellspacing="0">
<tr align="center" bgcolor="#FFFF00">
<td width="200">IP Address</td>
<td width="200">In Flow Rate</td>
<td width="200">Out flow Rate</td>
</tr>
EOF
}
}
for my $ip (keys %first_input) {
if ($ZERO != 1) {
if (defined $second_input{$ip} and defined $second_output{$ip} and int(($second_input{$ip}-$first_input{$ip})/1024/$SEC) == 0) {
next;
}
}
if (defined $second_input{$ip} and defined $second_output{$ip}) {
$input_rate = ($second_input{$ip}-$first_input{$ip})/1024/$SEC;
$output_rate = ($second_output{$ip}-$first_output{$ip})/1024/$SEC;
if (! defined $BANIP) {
if (! defined $HTML) {
printf ("%s\t\t%.f KByte/s\t%.f KByte/s\n",$ip,$input_rate,$output_rate);
}
else {
printf ("<tr><td>%s</td>\n<td>%.f KByte/s</td>\n<td>%.f KByte/s</td>\n</tr>\n",$ip,$input_rate,$output_rate);
}
}
if ($input_rate >= $limit_input_rate and ! grep ("192.168.228.$_" eq $ip,@exclude_ip)) {
#system ("$BANIP_CMD INPUT $ip $BANSEC &");
print $ip,"\n" if defined $BANIP;
$ban_ip{$ip}=1;
}
if ($output_rate >= $limit_output_rate and ! grep ("192.168.228.$_" eq $ip,@exclude_ip)) {
#system ("$BANIP_CMD OUTPUT $ip $BANSEC &");
print $ip,"\n" if defined $BANIP;
$ban_ip{$ip}=1;
}
}
}
if (! defined $BANIP) {
if (! defined $HTML) {
print "-"x53,"\n";
print "Banned IP Address:\n";
}
else {
print<<EOF;
</table></td></tr>
<tr><td><p><br></p></td></tr>
<tr><td><table border="1" align="left" cellspacing="0">
<tr>
<td width="200" align="center" bgcolor="#FF0000">Banned IP Address</td>
</tr>
EOF
}
}
if (! defined $BANIP) {
for (keys %ban_ip) {
if (! defined $HTML) {
print "$_\n";
}
else {
print<<EOF;
<tr>
<td>$_</td>
</tr>
EOF
}
}
}
if (defined $HTML) {
print<<EOF;
</table></td></tr></td></table>
<br>
限速：200 KByte/s，若检查时发现超出该值，会自动中断对应的客户端IP一分钟。
若您被中断了，请等待。
EOF
}
复制代码
调用的脚本：
#!/bin/bash
for i in `/root/ipflow.pl -b`
do
/root/banip.sh INPUT $i 60 &
done
复制代码
另一个会被调用的脚本：
# Date:2009-03-12
# Author:HyphenWang
# Version:1.0
SEC="$3";
IPTABLES="/sbin/iptables"
case $1 in
"INPUT")
$IPTABLES -I FORWARD -d $2 -j DROP
;;
"OUTPUT")
$IPTABLES -I FORWARD -s $2 -j DROP
;;
esac
sleep $SEC;
case $1 in
"INPUT")
$IPTABLES -D FORWARD -d $2 -j DROP
;;
"OUTPUT")
$IPTABLES -D FORWARD -s $2 -j DROP
;;
esac
exit 0
复制代码
以上三个文件都放在/root目录中的，设置权限执行，我没学perl，希望熟悉的高手帮我转写成BASH脚本。谢谢！
