search

jgmdev / ddos-deflate

Fork of DDoS Deflate with fixes, improvements and new features.
Other
760 stars 262 forks source link

How to record connections details of the IP that is getting blocked? #43

Open slrslr opened 6 years ago

slrslr commented 6 years ago

Hello,

when an IP is blocked i am sent an e-mail by the ddos.sh where i add links to the services like:

https://www.abuseipdb.com/check/54.172.1.44 http://blacklist.myip.ms/54.172.1.44 https://censys.io/ipv4/54.172.1.44/whois https://cymon.io/54.172.1.44

Discover accessed domain: /bin/sh /scripts/ip2logfile 54.172.1.44

This way i can see details or abuse reports for this IP and i can manualy execute my ip2logfile script to check various log files for this IP and see what that IP was doing. But i do not include this script output into mailfile nor netstat details into mailfile not to put high load on server when it is "attacked" by bad IP's.

Is it good idea, or do you suggest any commands that can tell me as much details about attacking IP as possible?

I tried:

echo "First 100 netstat entries:\n" netstat -ntu | tr -d \r|grep "$CURR_LINE_IP"|head -n 100 >> "$BANNED_IP_MAIL"

and a few other ways, but it never appear in the e-mail. Or do you suggest other way to discover/record as much data about IP as possible?