Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 425
  • Last Modified:

This output is given from : sflowtool -4 -p 3601 | /scripts/DoSTargets

I have 2 databases
1. ip.whitelist have only one column with ip name
2. ip.Block have 3 columns ip,reason,zaman

i have a sample output on flow as given below

sflowtool -4 -p 3601  | /scripts/DoSTargets


1387652837 178.20.228.47 15 mbps
1387652837 178.20.228.47 1792 pps
1387652837 185.9.156.35 11 mbps
1387652837 185.9.159.233 1536 pps
1387652838 185.9.156.35 11 mbps
1387652839 178.20.228.47 26 mbps
1387652839 178.20.228.47 2560 pps
1387652839 85.100.207.114 8 mbps
1387652840 178.20.228.47 27 mbps
1387652840 178.20.228.47 3072 pps
1387652840 185.9.159.233 12 mbps
1387652840 185.9.159.233 2304 pps
1387652841 178.20.228.47 20 mbps
1387652841 178.20.228.47 2048 pps
1387652841 89.253.155.97 8 mbps
1387652842 178.20.228.47 20 mbps
1387652842 178.20.228.47 1792 pps
1387652843 178.20.228.47 15 mbps
1387652843 178.20.228.47 1792 pps

Open in new window




i want sth. like this.

sflowtool -4 -p 3601  | /scripts/DoSTargets  | perl DDOSrecorder.pl

and if the traffic is bigger then 100mbps or 25000 pps it will check the ip.whitelist
and if it is not in white listed table it will only add the ip address to the ip.block table
reason column will only include the Xmbps or Xpps  to understand the blocking
0
3XLcom
Asked:
3XLcom
1 Solution
 
ozoCommented:
my %X=(
mbps => 100,
pps => 25000,
);
open W,"<ip.whitelist" or die "<ip.whitelist $!";
chomp,++$w{$_} while <W>;
close W;
open STDOUT,">>ip.block" or die ">>ip.block $!";
while( <> ){
  my @F=split;
  print "$F[1,2,3]\n" if !$w{$F[1]} && $F[2]>$X{$F[3]};
}
0
 
3XLcomAuthor Commented:
thnx
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now