add some ddos script

ddos/check_nginx-admin.sh

+#!/bin/sh
+
+cd $(dirname $0)
+
+# uncomment one of
+#MAXPERC=40
+MAXNUM=60
+
+MAXLIST=30
+
+. config
+
+get_already_dropped()
+{
+        /sbin/iptables -L -n | grep DROP | awk '{print $4;}' > ipt.dropped.list
+}
+
+do_drop()
+{
+        IP="$1"
+        #IP="${IP%.*}.0/24"
+        grep -q "$IP" ipt.dropped.list white.list && return 1
+        echo "$IP # $3 ($2 percent), $(date) by $0" >> dropped.list
+        /sbin/iptables -A INPUT -s $IP -j DROP
+}
+
+get_already_dropped
+
+echo "Tail *access.log..."
+#tail -n 1000 /var/log/nginx/*access.log | awk '{print $1;}' | \
+#    grep -v "127.0.0.1" | grep -v "0.0.0.0" | grep -v "$OURIP1" | sort > full.list
+
+timeout 3 tail -n 1000 /var/log/nginx/access-admin.log | awk '{print $1;}' | \
+    grep -v "127.0.0.1" | grep -v "0.0.0.0" | grep -v "$OURIP1" |  sort > full.list
+
+NUMP=$(cat full.list | wc -l)
+NUMPUNIQ=$(cat full.list | sort -u | wc -l)
+
+echo "Sort results..."
+cat full.list | uniq -c | sort -r -n | head -n $MAXLIST > attack.list
+
+TOTALATTACKED=0
+TOTALALREADY=0
+while read c ip ; do
+        [ -n "$ip" ] || continue
+        grep -q $ip white.list && { echo Skip; continue; }
+        perc=$((100*$c/$NUMP))
+        echo "$c = $ip ($NUMP, $perc)"
+        [ -n "$MAXPERC" ] && IFCASE="$perc -ge $MAXPERC" || IFCASE="$c -ge $MAXNUM"
+        if [ $IFCASE ] ; then
+                if do_drop $ip $perc $c ; then
+                    echo "Drop IP $ip with $perc percent traffic"
+                    TOTALATTACKED=$(($TOTALATTACKED+$c))
+                else
+                    echo "IP $ip already dropped"
+                    TOTALALREADY=$(($TOTALALREADY+$c))
+                fi
+        fi
+done < attack.list
+
+echo "Checked packages: $NUMP ($NUMPUNIQ unique). Attacker: $TOTALATTACKED ( $((TOTALATTACKED*100/$NUMP)) %) Already percent: $TOTALALREADY ( $((TOTALALREADY*100/$NUMP)) %)" | tee result.out

ddos/check_ruadmin.sh

+#!/bin/sh
+cat full.list | sort -u | while read ip ; do
+    resolve $ip
+    sleep 1
+done
\ No newline at end of file