Identify IPs from DB error reports. DDoS Attack.

[Ranma2k]

ًwell i faced alot of DDOS before on my site
and since i only have 1 site on the server it started blocking the ip with the following command
you need to have root access :

first i get the ips using the command

netstat -an | grep :80 | awk '{print $5}' | cut -d ':' -f1 | sort | uniq -c | sort -nr


it will give a lit of the IP's with the number of connections that ip oppned the list will be like this


<Con. count> < ip >
421 254.243.21.36



What i do next is to get all the ip's that have a connection over 100 and block them
( sometime even above 50 )

then after a day or 2 i remove the block ..
worked with me and the site still standing


btw there is a script that can do this for you
you can find it there
http://blog.medialayer.com/projects-ddos-deflate/

hope that helps